Overview

overview

10

Static

static

10

878b3b9f08...93.exe

windows7-x64

10

878b3b9f08...93.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    878b3b9f08d9a94ce1a6e49b052fd5256e8135e73ddb15bb5b27580d8f18cf93

  • Size

    651KB

  • Sample

    221205-za8khsdf42

  • MD5

    d8dd32579ae811d5425ea74a222bd10f

  • SHA1

    ed9bd4a51b9af42f5d5f7b0d48160e21da7f70fc

  • SHA256

    878b3b9f08d9a94ce1a6e49b052fd5256e8135e73ddb15bb5b27580d8f18cf93

  • SHA512

    b14e7169a476886c641b2f0af3b33ac62a905e99e530338647e6af9d008bb817bcb14dbc00050f6c9deda4c38e6ab907291e28443855717e85cf00c5fbe0c310

  • SSDEEP

    12288:kpyZT1NrCxu/mDwLRI6BxcDqp9aqCcajVuD3Z7BPQGMWYur0s0D:kUx1NjOD3SxcDDcNDqWYurL0

Score
10/10
modiloaderevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      878b3b9f08d9a94ce1a6e49b052fd5256e8135e73ddb15bb5b27580d8f18cf93

    • Size

      651KB

    • MD5

      d8dd32579ae811d5425ea74a222bd10f

    • SHA1

      ed9bd4a51b9af42f5d5f7b0d48160e21da7f70fc

    • SHA256

      878b3b9f08d9a94ce1a6e49b052fd5256e8135e73ddb15bb5b27580d8f18cf93

    • SHA512

      b14e7169a476886c641b2f0af3b33ac62a905e99e530338647e6af9d008bb817bcb14dbc00050f6c9deda4c38e6ab907291e28443855717e85cf00c5fbe0c310

    • SSDEEP

      12288:kpyZT1NrCxu/mDwLRI6BxcDqp9aqCcajVuD3Z7BPQGMWYur0s0D:kUx1NjOD3SxcDDcNDqWYurL0

    Score
    10/10
    modiloaderevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • ModiLoader Second Stage

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks