Behavioral task
behavioral1
Sample
server.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
server.exe
Resource
win10v2004-20220812-en
General
-
Target
bf5ac66eccac91832d24af630335aa4291b392cb6d5d5bf8516f7057f08f9aa8
-
Size
2.1MB
-
MD5
86036e4ae84f9aa083fbecafb58a23ba
-
SHA1
0baffb387a8a3c80de9f423128f267f1aed06a05
-
SHA256
bf5ac66eccac91832d24af630335aa4291b392cb6d5d5bf8516f7057f08f9aa8
-
SHA512
597c3700d10374fff14c1d7b2351c0b48597c1ebe059a4415b10522ba9fab40883a59b23ec411fc8737bc2194b24f3a5c964690deabf49cd9006b7fcae7c6448
-
SSDEEP
49152:iFgmhVmxEowVIgPREJPpnM2g7Qm1j7DtQ6xA/SJHX2rRkhj:iTVmxNAlPKPXiJd9O6qRK
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule static1/unpack001/server.exe modiloader_stage2 -
Modiloader family
Files
-
bf5ac66eccac91832d24af630335aa4291b392cb6d5d5bf8516f7057f08f9aa8.cab
-
server.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Server Size: 1.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE