Overview

overview

10

Static

static

5

ef8cfc4a09...84.exe

windows7-x64

10

ef8cfc4a09...84.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ef8cfc4a0987054e9bf940f3bc2cb619048bdafa06b47b76d568a064bbd14f84

  • Size

    817KB

  • Sample

    221129-v8x48aba65

  • MD5

    790137d1f43d3d6188176ec1a8e0859a

  • SHA1

    2d09f857a5b4e3fbc12a5f66c237554c2a152399

  • SHA256

    ef8cfc4a0987054e9bf940f3bc2cb619048bdafa06b47b76d568a064bbd14f84

  • SHA512

    3dc67be70783cde0e3cdd708560d7c0ca7836a7eddbaa71cb3fdd449357deaf120fcf011bc63bc9a951697fabee2fc84436abf88e3c5c17739ed53f058ec0a1e

  • SSDEEP

    12288:ehkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aC/LqtT6BDIEIXKFNHl:uRmJkcoQricOIQxiZY1iaC/LqtyIa5

Score
10/10
modiloaderpersistencetrojanupx

Malware Config

Targets

    • Target

      ef8cfc4a0987054e9bf940f3bc2cb619048bdafa06b47b76d568a064bbd14f84

    • Size

      817KB

    • MD5

      790137d1f43d3d6188176ec1a8e0859a

    • SHA1

      2d09f857a5b4e3fbc12a5f66c237554c2a152399

    • SHA256

      ef8cfc4a0987054e9bf940f3bc2cb619048bdafa06b47b76d568a064bbd14f84

    • SHA512

      3dc67be70783cde0e3cdd708560d7c0ca7836a7eddbaa71cb3fdd449357deaf120fcf011bc63bc9a951697fabee2fc84436abf88e3c5c17739ed53f058ec0a1e

    • SSDEEP

      12288:ehkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aC/LqtT6BDIEIXKFNHl:uRmJkcoQricOIQxiZY1iaC/LqtyIa5

    Score
    10/10
    modiloaderpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks