Overview

overview

10

Static

static

10

fb627d58ef...74.exe

windows7-x64

10

fb627d58ef...74.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb627d58ef1fd5132cbf0b5ba70a66d34e7a2af2f869138bc80dc0e40ef2cf74

  • Size

    1.5MB

  • Sample

    221201-msenyaea3y

  • MD5

    e91589765d9ec212257a5c5b87160e11

  • SHA1

    c1674cd5d1d921ba005c682669daf5418b4484b3

  • SHA256

    fb627d58ef1fd5132cbf0b5ba70a66d34e7a2af2f869138bc80dc0e40ef2cf74

  • SHA512

    8aae1aa9f254090efb7e0939554644cedd8187291e6dcc2d964dc9c4dc83d97ad60a036f7e29384d33bbb836a930e8548a1f98a790f7a3aa8e942d8a3965abce

  • SSDEEP

    24576:JZKbCTDTyKoHPYo38YDzjKfbzfYlMCbStU4gf2EW5A2DJr/kS4vGIk6v3Hf:oCnTeIY6nY9bh43Dp/wPH

Score
10/10
modiloadertrojanupx

Malware Config

Targets

    • Target

      fb627d58ef1fd5132cbf0b5ba70a66d34e7a2af2f869138bc80dc0e40ef2cf74

    • Size

      1.5MB

    • MD5

      e91589765d9ec212257a5c5b87160e11

    • SHA1

      c1674cd5d1d921ba005c682669daf5418b4484b3

    • SHA256

      fb627d58ef1fd5132cbf0b5ba70a66d34e7a2af2f869138bc80dc0e40ef2cf74

    • SHA512

      8aae1aa9f254090efb7e0939554644cedd8187291e6dcc2d964dc9c4dc83d97ad60a036f7e29384d33bbb836a930e8548a1f98a790f7a3aa8e942d8a3965abce

    • SSDEEP

      24576:JZKbCTDTyKoHPYo38YDzjKfbzfYlMCbStU4gf2EW5A2DJr/kS4vGIk6v3Hf:oCnTeIY6nY9bh43Dp/wPH

    Score
    10/10
    modiloadertrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • ModiLoader Second Stage

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks