modiloader | 4b6cc04ec52357c0483d142018e4bd0535581912d5cb2b12e34dd71ed3f43dd0

General

Target

4b6cc04ec52357c0483d142018e4bd0535581912d5cb2b12e34dd71ed3f43dd0.exe
Size

1.0MB
Sample

221208-pwrh1sda3t
MD5

6ba9e47323d73f463b7ff58e074e6336
SHA1

cc1f04e4805756e698f9c81205b975cb5452d858
SHA256

4b6cc04ec52357c0483d142018e4bd0535581912d5cb2b12e34dd71ed3f43dd0
SHA512

608559edaf6256530832cbcf95e69a932499c6597384d9ce7b7756c0073eabf3df5ead2ba2548710ee5138de27434ae31424614afd34e2976c039e55f26633a4
SSDEEP

24576:M1ZIJHZxeAaa3RSGKzsozvq5oOqLM2xl/f:M1ZIEoQq5c/

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://drive.google.com/uc?export=download&id=1G6Bhh3ATcd3XGLeNSU7NvohuVsf0-dBL

Extracted

Family

warzonerat

C2

chexfotii.ddns.net:4545

Targets

- Target
  
  4b6cc04ec52357c0483d142018e4bd0535581912d5cb2b12e34dd71ed3f43dd0.exe
- Size
  
  1.0MB
- MD5
  
  6ba9e47323d73f463b7ff58e074e6336
- SHA1
  
  cc1f04e4805756e698f9c81205b975cb5452d858
- SHA256
  
  4b6cc04ec52357c0483d142018e4bd0535581912d5cb2b12e34dd71ed3f43dd0
- SHA512
  
  608559edaf6256530832cbcf95e69a932499c6597384d9ce7b7756c0073eabf3df5ead2ba2548710ee5138de27434ae31424614afd34e2976c039e55f26633a4
- SSDEEP
  
  24576:M1ZIJHZxeAaa3RSGKzsozvq5oOqLM2xl/f:M1ZIEoQq5c/
Score

10^/10

modiloader warzonerat collection infostealer persistence rat spyware stealer trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- ModiLoader Second Stage
- Warzone RAT payload
  rat
- Blocklisted process makes network request
- Sets DLL path for service in the registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Modifies WinLogon
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2