Behavioral task
behavioral1
Sample
e477a8097003204eb7f070ee081fdf996ad7239e4468b4a6bfc13abd36a4cd80.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e477a8097003204eb7f070ee081fdf996ad7239e4468b4a6bfc13abd36a4cd80.exe
Resource
win10v2004-20221111-en
General
-
Target
e477a8097003204eb7f070ee081fdf996ad7239e4468b4a6bfc13abd36a4cd80
-
Size
1.8MB
-
MD5
2ede29b32d18267e6a736be17d4f4664
-
SHA1
43673541f114e5071145932886e69266f0f3f166
-
SHA256
e477a8097003204eb7f070ee081fdf996ad7239e4468b4a6bfc13abd36a4cd80
-
SHA512
6af657c000f19f0ab3b47fcffe2e1e80cb5bf55cb5096a2ad467e4a2eb2f6ac5398b9b57747e098d1331d46bcc6282786cc3804976bce0838ae837ec0fbed63d
-
SSDEEP
49152:AoQU9Z5Y4+YSembcj3jjTcDuNML851cM9whEWby9o1Kx0J7w:AoQU9Z64+YFmb03jju0ML8ncMmGWbyqY
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Processes:
resource yara_rule sample upx
Files
-
e477a8097003204eb7f070ee081fdf996ad7239e4468b4a6bfc13abd36a4cd80.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: 956KB - Virtual size: 956KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 353KB - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE