Overview

overview

10

Static

static

810b68a8aa...cc.exe

windows7-x64

10

810b68a8aa...cc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    810b68a8aa8f705f4e9fb7883814317091e925768ba6676315728f8497b041cc

  • Size

    282KB

  • Sample

    221127-s3fxmscg51

  • MD5

    0360a57504a77922e14774b2ed52386d

  • SHA1

    6377f2d6db458f1150e5492eff88e7edba4a8589

  • SHA256

    810b68a8aa8f705f4e9fb7883814317091e925768ba6676315728f8497b041cc

  • SHA512

    4909a58cf600b2be157f79b817a9ba7df2ba9e616d460772868e6a3983479f67c8fb00da70119bef8fe2368505a9f7a7ea8e47301eab376c04faf99eae548111

  • SSDEEP

    6144:0WwuseuUo+524rAiO2PwM7vOxLrGPBfNO4ic18Ugee3akbRjo:Jwuserxdr7O2Pwq2prGpoU9wakbRjo

Score
10/10
modiloaderpersistencetrojanupx

Malware Config

Targets

    • Target

      810b68a8aa8f705f4e9fb7883814317091e925768ba6676315728f8497b041cc

    • Size

      282KB

    • MD5

      0360a57504a77922e14774b2ed52386d

    • SHA1

      6377f2d6db458f1150e5492eff88e7edba4a8589

    • SHA256

      810b68a8aa8f705f4e9fb7883814317091e925768ba6676315728f8497b041cc

    • SHA512

      4909a58cf600b2be157f79b817a9ba7df2ba9e616d460772868e6a3983479f67c8fb00da70119bef8fe2368505a9f7a7ea8e47301eab376c04faf99eae548111

    • SSDEEP

      6144:0WwuseuUo+524rAiO2PwM7vOxLrGPBfNO4ic18Ugee3akbRjo:Jwuserxdr7O2Pwq2prGpoU9wakbRjo

    Score
    10/10
    modiloaderpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks