General

  • Target

    480da40ba03cdfa381faabbf0fd6cf18f430bc78ae2e4eadd8701b185ceabb91

  • Size

    206KB

  • Sample

    221125-z2sy5sac8z

  • MD5

    64b1806803ac0f67bd31687430932f3e

  • SHA1

    dea8809f8ba4270497b937012c180680f3ff0e3a

  • SHA256

    480da40ba03cdfa381faabbf0fd6cf18f430bc78ae2e4eadd8701b185ceabb91

  • SHA512

    cc5cb15e30c07bea1d3b4ea2620a1b83ed54e2e49625dcbb0e435ecb4852f5cce7c3297f213e7d8341a8c3ea074b23bf5b503e23fa451a6c8508d642132822f1

  • SSDEEP

    6144:lG7u6jrkwvKaXR0cyYLF6lcBapBdd2nPd:U7u6jvnXRsLiATYPd

Malware Config

Targets

    • Target

      480da40ba03cdfa381faabbf0fd6cf18f430bc78ae2e4eadd8701b185ceabb91

    • Size

      206KB

    • MD5

      64b1806803ac0f67bd31687430932f3e

    • SHA1

      dea8809f8ba4270497b937012c180680f3ff0e3a

    • SHA256

      480da40ba03cdfa381faabbf0fd6cf18f430bc78ae2e4eadd8701b185ceabb91

    • SHA512

      cc5cb15e30c07bea1d3b4ea2620a1b83ed54e2e49625dcbb0e435ecb4852f5cce7c3297f213e7d8341a8c3ea074b23bf5b503e23fa451a6c8508d642132822f1

    • SSDEEP

      6144:lG7u6jrkwvKaXR0cyYLF6lcBapBdd2nPd:U7u6jvnXRsLiATYPd

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • ModiLoader Second Stage

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Tasks