Extracted

• • Target

    bf9e9aa73bdf6953aed1450fb44751835f49441d87553ba87c13b94bc086a387

  • Size

    606KB

  • MD5

    917545581c785ea781b920527932a908

  • SHA1

    fb3c0c5e31f4682d09f9bca256c3ea0fc8b180e6

  • SHA256

    bf9e9aa73bdf6953aed1450fb44751835f49441d87553ba87c13b94bc086a387

  • SHA512

    ac093cf88871c9c7bc87c50c420d6640faa593eb484fcc7536bd610069b38b0d40f936c145e709f7475eca43fb5a00cc22a1e168a634593131d8637951d30593

  • SSDEEP

    12288:URmdtjPWedI4ilnP/TP7xQLtV8TuJ+fUoy6SoMvPJ6Q/FO0cn2b:URmdRZ4nTVQLtVsuEfUoy6MHJ6SFOW

  Score

  10^/10

  modiloadersalityaspackv2backdoorevasiontrojanupx

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • ModiLoader Second Stage

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2