Overview

overview

10

Static

static

3b798b5a4d...f1.exe

windows7-x64

10

3b798b5a4d...f1.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3b798b5a4dba309f1a9e0f1a460763a6e4b6255b037a63505afa83eb19d8fff1

  • Size

    152KB

  • Sample

    221126-hlbaqaab92

  • MD5

    a1444159f92a85f48d8fedd145585af0

  • SHA1

    ea743c7f55f5fffe88961e59071fd702aa6c93ec

  • SHA256

    3b798b5a4dba309f1a9e0f1a460763a6e4b6255b037a63505afa83eb19d8fff1

  • SHA512

    c3ff5ba36ce2a0a4fb6ebd447a1054c484f2719b44eaf38d81564ffa0a63206761db8b05cdb20def0a255066ec04db34a3901c75f0c8a953dc170db895b87232

  • SSDEEP

    1536:c1DMz1DQvXLq6t7awFONecenlLnQHIG5R9c73P600t:9eGw9A0rC00t

Score
10/10
modiloaderpersistencetrojanupx

Malware Config

Targets

    • Target

      3b798b5a4dba309f1a9e0f1a460763a6e4b6255b037a63505afa83eb19d8fff1

    • Size

      152KB

    • MD5

      a1444159f92a85f48d8fedd145585af0

    • SHA1

      ea743c7f55f5fffe88961e59071fd702aa6c93ec

    • SHA256

      3b798b5a4dba309f1a9e0f1a460763a6e4b6255b037a63505afa83eb19d8fff1

    • SHA512

      c3ff5ba36ce2a0a4fb6ebd447a1054c484f2719b44eaf38d81564ffa0a63206761db8b05cdb20def0a255066ec04db34a3901c75f0c8a953dc170db895b87232

    • SSDEEP

      1536:c1DMz1DQvXLq6t7awFONecenlLnQHIG5R9c73P600t:9eGw9A0rC00t

    Score
    10/10
    modiloaderpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks