modiloader | affc853616ecbcf46a4bc3db81c2d973d169638fdf5fe2fc229c12cb83161c8a

Sharing

Copy URL Twitter E-mail

General

Target
affc853616ecbcf46a4bc3db81c2d973d169638fdf5fe2fc229c12cb83161c8a
Size 812KB
Sample230129-mehtfaba73
SHA256 affc853616ecbcf46a4bc3db81c2d973d169638fdf5fe2fc229c12cb83161c8a
MD5 3a759f595cbc19907ec924b6563aa4a6
SHA1 b1b69c38d2251c5e9a1de27fd2972cf78efca008
SHA512 cb8c0d52f23c54ee7641bf45ba84d5fcceeb5c85d00fc0064fa700a9acb5f2046c6ca92eae853d6ff77877ddb2afc61a2735a6cbeb9c1da71076e435ff5a95f9
SSDEEP 12288:4YknjLpzBNoLE126lU1tMGjYIFW4+zyZGumGgTtrDJrPsfL4oTO27uqULG1R:4Ykjlzr+8lUCpeZM3BDhPC5u/G
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

File Explorer

affc853616ecbcf46a4bc3db81c2d973d169638fdf5fe2fc229c12cb83161c8a

.exe 812KB

affc853616ecbcf46a4bc3db81c2d973d169638fdf5fe2fc229c12cb83161c8a

SHA256 affc853616ecbcf46a4bc3db81c2d973d169638fdf5fe2fc229c12cb83161c8a
MD5 3a759f595cbc19907ec924b6563aa4a6
SHA1 b1b69c38d2251c5e9a1de27fd2972cf78efca008
SHA512 cb8c0d52f23c54ee7641bf45ba84d5fcceeb5c85d00fc0064fa700a9acb5f2046c6ca92eae853d6ff77877ddb2afc61a2735a6cbeb9c1da71076e435ff5a95f9
SSDEEP 12288:4YknjLpzBNoLE126lU1tMGjYIFW4+zyZGumGgTtrDJrPsfL4oTO27uqULG1R:4Ykjlzr+8lUCpeZM3BDhPC5u/G
MD5 SHA1 SHA512 SSDEEP

windows x86

ModiLoader Second Stage

Minor OS version

Major OS version

Entry point

48040

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ