General
-
Target
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7
-
Size
62KB
-
Sample
221126-trzfaabb7z
-
MD5
122a5ca7aee59f9c5ddeada803c56e4f
-
SHA1
d276687c119a98568638a6bb88feb9c6d4e78c4d
-
SHA256
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7
-
SHA512
08e89aba39f1f59094bf88fd1d717f6b6c195c5c278620224c32d2c81553caeaaea592b88f86b9cc9ee6ec8329c42b4e63626ae2a226093c0b106898eccec988
-
SSDEEP
1536:1o+yOVkQit5+oxRQvT65RxY91b3tGwbkg44iT8X:1o+ymkQit5evQvY3dGwbkghiQX
Static task
static1
Behavioral task
behavioral1
Sample
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7.exe
Resource
win10v2004-20220901-en
Malware Config
Targets
-
-
Target
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7
-
Size
62KB
-
MD5
122a5ca7aee59f9c5ddeada803c56e4f
-
SHA1
d276687c119a98568638a6bb88feb9c6d4e78c4d
-
SHA256
6cd37e4f010f02f83668c689d983cecc71dd5809f392d6c287d59a1e16d18cf7
-
SHA512
08e89aba39f1f59094bf88fd1d717f6b6c195c5c278620224c32d2c81553caeaaea592b88f86b9cc9ee6ec8329c42b4e63626ae2a226093c0b106898eccec988
-
SSDEEP
1536:1o+yOVkQit5+oxRQvT65RxY91b3tGwbkg44iT8X:1o+ymkQit5evQvY3dGwbkghiQX
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-