General
-
Target
d4f856a473edf29a1c2eb2718755bbe3c7fcc928db6984f00d04030b44255347
-
Size
173KB
-
Sample
221203-2d36baeh91
-
MD5
12b93bfce82eef65ae7fe39bf1177ec6
-
SHA1
db3889b2617237d0f8c6b0f326c78af2ccb2658e
-
SHA256
d4f856a473edf29a1c2eb2718755bbe3c7fcc928db6984f00d04030b44255347
-
SHA512
54f509bc15c97e8de83d902dee5ff78b8ae1900bcfd77b29796df56c80e7b649507b6d8eca21ee573781af432535b620eaf0bf67344008001e556dcf7db46aec
-
SSDEEP
3072:UyXo1wdb0+Th7Qbvmron2kuF0uhbEeYkAk1UFEpmHe05P4ekCMaSZwGD:Uy4mwKh7Gvmr1F7hoeFUFEcDPDkCJSCO
Static task
static1
Behavioral task
behavioral1
Sample
d4f856a473edf29a1c2eb2718755bbe3c7fcc928db6984f00d04030b44255347.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d4f856a473edf29a1c2eb2718755bbe3c7fcc928db6984f00d04030b44255347.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
d4f856a473edf29a1c2eb2718755bbe3c7fcc928db6984f00d04030b44255347
-
Size
173KB
-
MD5
12b93bfce82eef65ae7fe39bf1177ec6
-
SHA1
db3889b2617237d0f8c6b0f326c78af2ccb2658e
-
SHA256
d4f856a473edf29a1c2eb2718755bbe3c7fcc928db6984f00d04030b44255347
-
SHA512
54f509bc15c97e8de83d902dee5ff78b8ae1900bcfd77b29796df56c80e7b649507b6d8eca21ee573781af432535b620eaf0bf67344008001e556dcf7db46aec
-
SSDEEP
3072:UyXo1wdb0+Th7Qbvmron2kuF0uhbEeYkAk1UFEpmHe05P4ekCMaSZwGD:Uy4mwKh7Gvmr1F7hoeFUFEcDPDkCJSCO
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-