General
-
Target
a92898127820bd08fee66d928519ed552e33c6c5cd6f9f3e9206cadbd5667167
-
Size
108KB
-
Sample
221126-r5kg6sef3v
-
MD5
0bb625f8e2360406691d95e937c1f4ef
-
SHA1
5a4c3c86a56ec3a2ed112c8f1019d2e3340db8ec
-
SHA256
a92898127820bd08fee66d928519ed552e33c6c5cd6f9f3e9206cadbd5667167
-
SHA512
128dbb0dc1585eccd5b1e8799d937e212e888eb7063ee591a7f80c14bf4f03eee13620974c51010d9142ddb5835334e01d6394c874f39d0a7c524583f117635e
-
SSDEEP
3072:Z1+MJKrUnFYY5z1i0Nmbi5fJBNhLxKqKmu8out:PIrPj0NmWtNhxvKeoS
Behavioral task
behavioral1
Sample
a92898127820bd08fee66d928519ed552e33c6c5cd6f9f3e9206cadbd5667167.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a92898127820bd08fee66d928519ed552e33c6c5cd6f9f3e9206cadbd5667167.exe
Resource
win10v2004-20220901-en
Malware Config
Targets
-
-
Target
a92898127820bd08fee66d928519ed552e33c6c5cd6f9f3e9206cadbd5667167
-
Size
108KB
-
MD5
0bb625f8e2360406691d95e937c1f4ef
-
SHA1
5a4c3c86a56ec3a2ed112c8f1019d2e3340db8ec
-
SHA256
a92898127820bd08fee66d928519ed552e33c6c5cd6f9f3e9206cadbd5667167
-
SHA512
128dbb0dc1585eccd5b1e8799d937e212e888eb7063ee591a7f80c14bf4f03eee13620974c51010d9142ddb5835334e01d6394c874f39d0a7c524583f117635e
-
SSDEEP
3072:Z1+MJKrUnFYY5z1i0Nmbi5fJBNhLxKqKmu8out:PIrPj0NmWtNhxvKeoS
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-