Overview

overview

10

Static

static

ef1ef05a49...6e.exe

windows7-x64

10

ef1ef05a49...6e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ef1ef05a499cd7259ada4773cc6932129ff4da5ae9ac2d2ce0756196bf3efc6e

  • Size

    454KB

  • Sample

    221203-q17lgaef92

  • MD5

    f9e25196de78400471bfc86ba6a1b001

  • SHA1

    c5b814c0b4e45cf87cbce725f6e52f0c492cfbbd

  • SHA256

    ef1ef05a499cd7259ada4773cc6932129ff4da5ae9ac2d2ce0756196bf3efc6e

  • SHA512

    3be48fe0b6a91a97699779990439a23010099e97195965d722adf9f4dee107675b3c427398ec34cedf3918368b459c78d37639048e2ccd9f58af6d8a637f985d

  • SSDEEP

    12288:1rNG8e5lVblWi0HkQsmcApZuXZoL5NQ+WFlhGUfE2yY3PrgNaoUwFnd4TIYk:1rNG87i0HvBkEQ+2FfqYfrhzwtdZYk

Score
10/10
modiloadertrojan

Malware Config

Targets

    • Target

      ef1ef05a499cd7259ada4773cc6932129ff4da5ae9ac2d2ce0756196bf3efc6e

    • Size

      454KB

    • MD5

      f9e25196de78400471bfc86ba6a1b001

    • SHA1

      c5b814c0b4e45cf87cbce725f6e52f0c492cfbbd

    • SHA256

      ef1ef05a499cd7259ada4773cc6932129ff4da5ae9ac2d2ce0756196bf3efc6e

    • SHA512

      3be48fe0b6a91a97699779990439a23010099e97195965d722adf9f4dee107675b3c427398ec34cedf3918368b459c78d37639048e2ccd9f58af6d8a637f985d

    • SSDEEP

      12288:1rNG8e5lVblWi0HkQsmcApZuXZoL5NQ+WFlhGUfE2yY3PrgNaoUwFnd4TIYk:1rNG87i0HvBkEQ+2FfqYfrhzwtdZYk

    Score
    10/10
    modiloadertrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks