Overview

overview

10

Static

static

bbc07c5501...17.exe

windows7-x64

10

bbc07c5501...17.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bbc07c55011ead9aa4a0d4ccca7aa4e651e147dcf0b45f234d83a1bacba1c917

  • Size

    152KB

  • Sample

    221125-x8qfgsdc4w

  • MD5

    eb9f28b6b0877b9a39f3f6f0eefef9a0

  • SHA1

    ea399d5d13ac71039cdc70d13f9d697ca1acc853

  • SHA256

    bbc07c55011ead9aa4a0d4ccca7aa4e651e147dcf0b45f234d83a1bacba1c917

  • SHA512

    cc257f6cd72a0972fc651e8af54be0d924ad8336f613b39233f7267216f3b45c5506559617db166711097ac129fc464460efa7fcfa3e555d2b12b92386b4ed5a

  • SSDEEP

    1536:c1DMz1DQvXLq6t7awFONecenlLnQHIG5R9c73P600t:9eGw9A0rC00t

Score
10/10
modiloaderpersistencetrojanupx

Malware Config

Targets

    • Target

      bbc07c55011ead9aa4a0d4ccca7aa4e651e147dcf0b45f234d83a1bacba1c917

    • Size

      152KB

    • MD5

      eb9f28b6b0877b9a39f3f6f0eefef9a0

    • SHA1

      ea399d5d13ac71039cdc70d13f9d697ca1acc853

    • SHA256

      bbc07c55011ead9aa4a0d4ccca7aa4e651e147dcf0b45f234d83a1bacba1c917

    • SHA512

      cc257f6cd72a0972fc651e8af54be0d924ad8336f613b39233f7267216f3b45c5506559617db166711097ac129fc464460efa7fcfa3e555d2b12b92386b4ed5a

    • SSDEEP

      1536:c1DMz1DQvXLq6t7awFONecenlLnQHIG5R9c73P600t:9eGw9A0rC00t

    Score
    10/10
    modiloaderpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks