General
-
Target
88a8c584d56f7c6abff020366136639f22d197c5fa0a7b932199bcc3e65d4efd
-
Size
826KB
-
Sample
221201-pfwsssfd49
-
MD5
3bafb9e09df62e6d89ca3a7edf06b099
-
SHA1
2925b3ae7d5758535f4effdc419591377aeb8992
-
SHA256
88a8c584d56f7c6abff020366136639f22d197c5fa0a7b932199bcc3e65d4efd
-
SHA512
b3deb5c57c6e53ce9ccbee89f4f45e9d1fbf405151bfdc811b732ee7312ad763ff6641b3dca06c80ee95bb5bc22aa0fb6984be17b0db46a93b239db3fc940bc3
-
SSDEEP
24576:KO2emsEzSdJxe4JlKgRhk1Fvkif+2vUTlZzTElifi:KhsEzkHKqq1Fv+2vMltd
Static task
static1
Behavioral task
behavioral1
Sample
88a8c584d56f7c6abff020366136639f22d197c5fa0a7b932199bcc3e65d4efd.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
88a8c584d56f7c6abff020366136639f22d197c5fa0a7b932199bcc3e65d4efd.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
88a8c584d56f7c6abff020366136639f22d197c5fa0a7b932199bcc3e65d4efd
-
Size
826KB
-
MD5
3bafb9e09df62e6d89ca3a7edf06b099
-
SHA1
2925b3ae7d5758535f4effdc419591377aeb8992
-
SHA256
88a8c584d56f7c6abff020366136639f22d197c5fa0a7b932199bcc3e65d4efd
-
SHA512
b3deb5c57c6e53ce9ccbee89f4f45e9d1fbf405151bfdc811b732ee7312ad763ff6641b3dca06c80ee95bb5bc22aa0fb6984be17b0db46a93b239db3fc940bc3
-
SSDEEP
24576:KO2emsEzSdJxe4JlKgRhk1Fvkif+2vUTlZzTElifi:KhsEzkHKqq1Fv+2vMltd
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-