modiloader | c7b571d8b889466d791b474515aab705b2ec7f0b3a1a434dccb8cdaf265216fb

General

Target

c7b571d8b889466d791b474515aab705b2ec7f0b3a1a434dccb8cdaf265216fb
Size

606KB
Sample

221129-28v37abd61
MD5

887ac3a14b1b18d94925b05201e9fe66
SHA1

ff20f17ede14c87191b7e8923ed7590a9e578001
SHA256

c7b571d8b889466d791b474515aab705b2ec7f0b3a1a434dccb8cdaf265216fb
SHA512

7f3c40008a7792fa8e90825c9ee0cfecc9d37ad3708cf18f94098bca867b5861ddfd7fdc76abd5a4a6e2ed32e14d7bdbbc0a94b7a12524dd6cdd85ba9578c91e
SSDEEP

12288:UR/dtjPWedI4ilnP/TP7xQLtV8TuJ+fUoy6SoMvPJ6Q/FO0cn2b:UR/dRZ4nTVQLtVsuEfUoy6MHJ6SFOW

Score

10^/10

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  c7b571d8b889466d791b474515aab705b2ec7f0b3a1a434dccb8cdaf265216fb
- Size
  
  606KB
- MD5
  
  887ac3a14b1b18d94925b05201e9fe66
- SHA1
  
  ff20f17ede14c87191b7e8923ed7590a9e578001
- SHA256
  
  c7b571d8b889466d791b474515aab705b2ec7f0b3a1a434dccb8cdaf265216fb
- SHA512
  
  7f3c40008a7792fa8e90825c9ee0cfecc9d37ad3708cf18f94098bca867b5861ddfd7fdc76abd5a4a6e2ed32e14d7bdbbc0a94b7a12524dd6cdd85ba9578c91e
- SSDEEP
  
  12288:UR/dtjPWedI4ilnP/TP7xQLtV8TuJ+fUoy6SoMvPJ6Q/FO0cn2b:UR/dRZ4nTVQLtVsuEfUoy6MHJ6SFOW
Score

10^/10

modiloader sality aspackv2 backdoor evasion trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- ModiLoader Second Stage
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2