General
-
Target
2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292
-
Size
67KB
-
Sample
221126-slqerach84
-
MD5
0f9431680d0faef375d72c7891ad4cce
-
SHA1
a22e289b3280369fbcda6bbd69be817a68face75
-
SHA256
2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292
-
SHA512
b859f0d022d1bb2fe2d242ddb8b31c65a02a918247ff15fc85508d9db63c7a04c8a50f64433ab635fdef90ada0ebf0b1a72d9fa0c0e9557a145f2dde5a9dd18d
-
SSDEEP
1536:xvu67jVd881H9+LsD8T5Ilppe2/ezI2PesVXZNh:xvu67jb881d+gD8T2lppeFI2Pe01
Static task
static1
Behavioral task
behavioral1
Sample
2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292
-
Size
67KB
-
MD5
0f9431680d0faef375d72c7891ad4cce
-
SHA1
a22e289b3280369fbcda6bbd69be817a68face75
-
SHA256
2b8126f13a47608514341f54f3fb0b10f74a0cfc2ab2b6b05fd36c71095ee292
-
SHA512
b859f0d022d1bb2fe2d242ddb8b31c65a02a918247ff15fc85508d9db63c7a04c8a50f64433ab635fdef90ada0ebf0b1a72d9fa0c0e9557a145f2dde5a9dd18d
-
SSDEEP
1536:xvu67jVd881H9+LsD8T5Ilppe2/ezI2PesVXZNh:xvu67jb881d+gD8T2lppeFI2Pe01
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-