modiloader | e7fc8ad3234cd36125d7e4dff63efc6fc55128d2e95e9224a8f0a3e929f4d317

General

Target

e7fc8ad3234cd36125d7e4dff63efc6fc55128d2e95e9224a8f0a3e929f4d317
Size

606KB
Sample

221129-246zwsfg89
MD5

a80b4c1bdf6c5497a91f2f0f692fb56c
SHA1

fe9a073ac505e257920c4e2d077697fcd43301de
SHA256

e7fc8ad3234cd36125d7e4dff63efc6fc55128d2e95e9224a8f0a3e929f4d317
SHA512

193d66eacb7f1de43d8df49f57bf5891099c375febe8ff79d816ac7a3eded2a913b84ce1f38050af2e9661c91f39bfbac916e3588b6c913d93776d8f4e4bbc47
SSDEEP

12288:LRmdtjPWedI4ilnP/TP7xQLtV8TuJ+fUoy6SoMvPJ6Q/FO0cn2b:LRmdRZ4nTVQLtVsuEfUoy6MHJ6SFOW

Score

10^/10

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  e7fc8ad3234cd36125d7e4dff63efc6fc55128d2e95e9224a8f0a3e929f4d317
- Size
  
  606KB
- MD5
  
  a80b4c1bdf6c5497a91f2f0f692fb56c
- SHA1
  
  fe9a073ac505e257920c4e2d077697fcd43301de
- SHA256
  
  e7fc8ad3234cd36125d7e4dff63efc6fc55128d2e95e9224a8f0a3e929f4d317
- SHA512
  
  193d66eacb7f1de43d8df49f57bf5891099c375febe8ff79d816ac7a3eded2a913b84ce1f38050af2e9661c91f39bfbac916e3588b6c913d93776d8f4e4bbc47
- SSDEEP
  
  12288:LRmdtjPWedI4ilnP/TP7xQLtV8TuJ+fUoy6SoMvPJ6Q/FO0cn2b:LRmdRZ4nTVQLtVsuEfUoy6MHJ6SFOW
Score

10^/10

modiloader sality aspackv2 backdoor evasion trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- ModiLoader Second Stage
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2