modiloader | bf9e9aa73bdf6953aed1450fb44751835f49441d87553ba87c13b94bc086a387

General

Target

bf9e9aa73bdf6953aed1450fb44751835f49441d87553ba87c13b94bc086a387
Size

606KB
Sample

221129-299yqsgd29
MD5

917545581c785ea781b920527932a908
SHA1

fb3c0c5e31f4682d09f9bca256c3ea0fc8b180e6
SHA256

bf9e9aa73bdf6953aed1450fb44751835f49441d87553ba87c13b94bc086a387
SHA512

ac093cf88871c9c7bc87c50c420d6640faa593eb484fcc7536bd610069b38b0d40f936c145e709f7475eca43fb5a00cc22a1e168a634593131d8637951d30593
SSDEEP

12288:URmdtjPWedI4ilnP/TP7xQLtV8TuJ+fUoy6SoMvPJ6Q/FO0cn2b:URmdRZ4nTVQLtVsuEfUoy6MHJ6SFOW

Score

10^/10

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  bf9e9aa73bdf6953aed1450fb44751835f49441d87553ba87c13b94bc086a387
- Size
  
  606KB
- MD5
  
  917545581c785ea781b920527932a908
- SHA1
  
  fb3c0c5e31f4682d09f9bca256c3ea0fc8b180e6
- SHA256
  
  bf9e9aa73bdf6953aed1450fb44751835f49441d87553ba87c13b94bc086a387
- SHA512
  
  ac093cf88871c9c7bc87c50c420d6640faa593eb484fcc7536bd610069b38b0d40f936c145e709f7475eca43fb5a00cc22a1e168a634593131d8637951d30593
- SSDEEP
  
  12288:URmdtjPWedI4ilnP/TP7xQLtV8TuJ+fUoy6SoMvPJ6Q/FO0cn2b:URmdRZ4nTVQLtVsuEfUoy6MHJ6SFOW
Score

10^/10

modiloader sality aspackv2 backdoor evasion trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- ModiLoader Second Stage
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2