General
-
Target
80112a1465755d890359f4f346858aaaf826b52b279fca10dfc2101eb77106e1
-
Size
134KB
-
Sample
221201-pjn75aff62
-
MD5
6d1d5a6d8155b8d66e7bdec2882e71b6
-
SHA1
0ac751a1d41a59f40cc0f6fd7723f050f76cba9c
-
SHA256
80112a1465755d890359f4f346858aaaf826b52b279fca10dfc2101eb77106e1
-
SHA512
6433150739962dec7eede77de70065ce4a8ad6a84213ce78d1c6cffd7135c70236793af8715b04655715b93860a8aacd1e1938c7f8be188e6719c0e76c5dbabc
-
SSDEEP
3072:e106TCh4tKFwb4KxYb2JX5fPXvVVVnwx9S:6x5hxYb2JhX9nGS
Static task
static1
Behavioral task
behavioral1
Sample
80112a1465755d890359f4f346858aaaf826b52b279fca10dfc2101eb77106e1.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
80112a1465755d890359f4f346858aaaf826b52b279fca10dfc2101eb77106e1.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
80112a1465755d890359f4f346858aaaf826b52b279fca10dfc2101eb77106e1
-
Size
134KB
-
MD5
6d1d5a6d8155b8d66e7bdec2882e71b6
-
SHA1
0ac751a1d41a59f40cc0f6fd7723f050f76cba9c
-
SHA256
80112a1465755d890359f4f346858aaaf826b52b279fca10dfc2101eb77106e1
-
SHA512
6433150739962dec7eede77de70065ce4a8ad6a84213ce78d1c6cffd7135c70236793af8715b04655715b93860a8aacd1e1938c7f8be188e6719c0e76c5dbabc
-
SSDEEP
3072:e106TCh4tKFwb4KxYb2JX5fPXvVVVnwx9S:6x5hxYb2JhX9nGS
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-