Extracted

• • Target

    de1f4e49565d4e46ff7ad03a07bd3e577f8db57536024810214c865f42a8e075

  • Size

    606KB

  • MD5

    57ec7e74b8af030875cc55878bec1df3

  • SHA1

    f9b5dccbd78f200d71ae8d85808b75b4f7712b8b

  • SHA256

    de1f4e49565d4e46ff7ad03a07bd3e577f8db57536024810214c865f42a8e075

  • SHA512

    60527d28e20ffb59a12060f4afcf9d163d830eeb60956f1d94a3af86636ce1fd47140cbbcf8ff6de627a1958f92673f8acaa296c21d3ecca63d19815a9f99b6e

  • SSDEEP

    12288:UR2dtjPWedI4ilnP/TP7xQLtV8TuJ+fUoy6SoMvPJ6Q/FO0cn2b:UR2dRZ4nTVQLtVsuEfUoy6MHJ6SFOW

  Score

  10^/10

  modiloadersalityaspackv2backdoorevasiontrojanupx

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • ModiLoader Second Stage

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2