General

  • Target

    0b20f45e87b9dfbcfde9077a0c447e2965f3a296c10ce62fc02ba027478d7379

  • Size

    249KB

  • Sample

    221125-z2vsqsfd64

  • MD5

    d2fa4331ca8bb9d9593bdf1a08a16bb8

  • SHA1

    db9cf3e42042d8468910825f3e22bfe3e0b5daec

  • SHA256

    0b20f45e87b9dfbcfde9077a0c447e2965f3a296c10ce62fc02ba027478d7379

  • SHA512

    7e2154d95adb0e8078b360de90c78ac002380ec1df95dce207cd322559f467d2832c5f03a80165a9b19d1cc3cbf62ad61cf2d69a23374a260c996c77fbbb01f9

  • SSDEEP

    6144:IG7u6jrkwvKaXR0cyYLF6lcBapBddx3ibykZgZ:h7u6jvnXRsLiATdIyf

Malware Config

Targets

    • Target

      0b20f45e87b9dfbcfde9077a0c447e2965f3a296c10ce62fc02ba027478d7379

    • Size

      249KB

    • MD5

      d2fa4331ca8bb9d9593bdf1a08a16bb8

    • SHA1

      db9cf3e42042d8468910825f3e22bfe3e0b5daec

    • SHA256

      0b20f45e87b9dfbcfde9077a0c447e2965f3a296c10ce62fc02ba027478d7379

    • SHA512

      7e2154d95adb0e8078b360de90c78ac002380ec1df95dce207cd322559f467d2832c5f03a80165a9b19d1cc3cbf62ad61cf2d69a23374a260c996c77fbbb01f9

    • SSDEEP

      6144:IG7u6jrkwvKaXR0cyYLF6lcBapBddx3ibykZgZ:h7u6jvnXRsLiATdIyf

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • ModiLoader Second Stage

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Tasks