General
-
Target
cddccf9837310b698aec00a3efa46f4e556bdfc487c956056d6f75c6327cdef8
-
Size
606KB
-
Sample
221129-27q3vaga93
-
MD5
74f4a091e8d89b102c75750204c6fb8a
-
SHA1
d99de7b16f6eee07de206c08b211219d6e8e231f
-
SHA256
cddccf9837310b698aec00a3efa46f4e556bdfc487c956056d6f75c6327cdef8
-
SHA512
4b2c2c3f7b34b2829d75eeb8258d02d3eeecdc7a1a7383bfb17f247fe3d31e208408c1db8dedab4bd7fb4a5143f2fc030f78525e2e724056393c35d3f766d279
-
SSDEEP
12288:URmdtjPWedI4ilnP/TP7xQL86SoMvPJ6Q/FO0cn2b:URmdRZ4nTVQL86MHJ6SFOW
Behavioral task
behavioral1
Sample
cddccf9837310b698aec00a3efa46f4e556bdfc487c956056d6f75c6327cdef8.exe
Resource
win7-20221111-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
cddccf9837310b698aec00a3efa46f4e556bdfc487c956056d6f75c6327cdef8
-
Size
606KB
-
MD5
74f4a091e8d89b102c75750204c6fb8a
-
SHA1
d99de7b16f6eee07de206c08b211219d6e8e231f
-
SHA256
cddccf9837310b698aec00a3efa46f4e556bdfc487c956056d6f75c6327cdef8
-
SHA512
4b2c2c3f7b34b2829d75eeb8258d02d3eeecdc7a1a7383bfb17f247fe3d31e208408c1db8dedab4bd7fb4a5143f2fc030f78525e2e724056393c35d3f766d279
-
SSDEEP
12288:URmdtjPWedI4ilnP/TP7xQL86SoMvPJ6Q/FO0cn2b:URmdRZ4nTVQL86MHJ6SFOW
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies firewall policy service
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-