General
-
Target
04778872ebfe19afd240d9242b58e7b6236c199d7edf3c21c974e40998ae0f1c
-
Size
116KB
-
Sample
221127-dj2bxahh2w
-
MD5
ef17d21ad9cdab3c972b9e925b1ceb33
-
SHA1
46358cea22fefaa33bd27a004b2e7903cbbf6190
-
SHA256
04778872ebfe19afd240d9242b58e7b6236c199d7edf3c21c974e40998ae0f1c
-
SHA512
33d3eecf88f984c5689ee1c33bb412089c81c4a52df81ad6d8038bd0533f370354bf55b0dc89eb8c8fdd0916a070d97612c2eb75901ecf7f44fb21f4bbb7f83c
-
SSDEEP
3072:CKjMubeiPfNEtjiJCxGGd/6Gh2CQeBnXvQfoyEaG:CKjbeZhJGGxh2nGXvQAxaG
Behavioral task
behavioral1
Sample
04778872ebfe19afd240d9242b58e7b6236c199d7edf3c21c974e40998ae0f1c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
04778872ebfe19afd240d9242b58e7b6236c199d7edf3c21c974e40998ae0f1c.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
04778872ebfe19afd240d9242b58e7b6236c199d7edf3c21c974e40998ae0f1c
-
Size
116KB
-
MD5
ef17d21ad9cdab3c972b9e925b1ceb33
-
SHA1
46358cea22fefaa33bd27a004b2e7903cbbf6190
-
SHA256
04778872ebfe19afd240d9242b58e7b6236c199d7edf3c21c974e40998ae0f1c
-
SHA512
33d3eecf88f984c5689ee1c33bb412089c81c4a52df81ad6d8038bd0533f370354bf55b0dc89eb8c8fdd0916a070d97612c2eb75901ecf7f44fb21f4bbb7f83c
-
SSDEEP
3072:CKjMubeiPfNEtjiJCxGGd/6Gh2CQeBnXvQfoyEaG:CKjbeZhJGGxh2nGXvQAxaG
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-