Overview

overview

10

Static

static

8f8ac9ac2a...e0.exe

windows7-x64

10

8f8ac9ac2a...e0.exe

windows10-2004-x64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f8ac9ac2ad77689deb3d0c8ab00db45ae62e935e90198fac16fe986bc7040e0

  • Size

    651KB

  • Sample

    221128-f41xzsde21

  • MD5

    35d2e776558e981d83b8b0b0408e7d99

  • SHA1

    bd56ed7c507fee65d2f00ca1e27099a0daff4fa6

  • SHA256

    8f8ac9ac2ad77689deb3d0c8ab00db45ae62e935e90198fac16fe986bc7040e0

  • SHA512

    986423d1051e9a854ddfe6490a7f05045b37e780fcc6774694236f7352e9af2c5cf880e740bf29f0e2bce3099a8d2ff77a81b6e6cba5bb470396589920131c8d

  • SSDEEP

    12288:/XQGwHlJQ42XqXSVeGqZBmuKNh7hxF3Z4mxxwEl74LdnKKnZWzyDC:4po48qi7bNl/QmXwy7InKK0z1

Score
10/10
modiloadertrojan

Malware Config

Targets

    • Target

      8f8ac9ac2ad77689deb3d0c8ab00db45ae62e935e90198fac16fe986bc7040e0

    • Size

      651KB

    • MD5

      35d2e776558e981d83b8b0b0408e7d99

    • SHA1

      bd56ed7c507fee65d2f00ca1e27099a0daff4fa6

    • SHA256

      8f8ac9ac2ad77689deb3d0c8ab00db45ae62e935e90198fac16fe986bc7040e0

    • SHA512

      986423d1051e9a854ddfe6490a7f05045b37e780fcc6774694236f7352e9af2c5cf880e740bf29f0e2bce3099a8d2ff77a81b6e6cba5bb470396589920131c8d

    • SSDEEP

      12288:/XQGwHlJQ42XqXSVeGqZBmuKNh7hxF3Z4mxxwEl74LdnKKnZWzyDC:4po48qi7bNl/QmXwy7InKK0z1

    Score
    10/10
    modiloadertrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks