Behavioral task
behavioral1
Sample
b5198b67210703e5cc83722924b67e98c5d087fa90d429a7a259041370fef7e1.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
b5198b67210703e5cc83722924b67e98c5d087fa90d429a7a259041370fef7e1.exe
Resource
win10v2004-20221111-en
General
-
Target
b5198b67210703e5cc83722924b67e98c5d087fa90d429a7a259041370fef7e1
-
Size
651KB
-
MD5
cccc0f64ed252c190e1b830c6f7bdfd7
-
SHA1
26a5ba838c680e8c0977347b95b1f8508e14b0ab
-
SHA256
b5198b67210703e5cc83722924b67e98c5d087fa90d429a7a259041370fef7e1
-
SHA512
31b01e86ba660f9546cbcc84b8e60e9275dd8c2a3720933ea5664a916f841c34442bf19c617fef6b0f480ac61a618c1b56f4f187889430ebe9f993034f0b385b
-
SSDEEP
12288:kpyZT18rCxu/mDwLRI6BxcDqp9aqCcajVuD3Z7BPQGMWYur0s0D:kUx18jOD3SxcDDcNDqWYurL0
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
Files
-
b5198b67210703e5cc83722924b67e98c5d087fa90d429a7a259041370fef7e1.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 66KB - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ