General
-
Target
4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2
-
Size
768KB
-
Sample
230210-an5y4sfb7y
-
MD5
60faea31bf224b220204dc167f1418f8
-
SHA1
7849870bd13daf80db63e11cc70b9082b427b60f
-
SHA256
4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2
-
SHA512
5870abc4939556654b60e538bfea254d83f6263a53434dda1c71bf09844dc0b6e146c1d943f8faedc66ae6b55c8e89df228a46337806ba0bb445c8a2ee4a5944
-
SSDEEP
12288:Zlm8oGNXxAKz3SiHxTqlC9KVlLaS0tZIANC2qywKHzAcCcu98sDa:bxoqxAKrSiHhqlC9yOHWUqybzYT9FD
Static task
static1
Behavioral task
behavioral1
Sample
4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
formbook
nvp4
EiywrQNofDNveWY1IESoBA==
yqEWFGRfErX7ICQCwyQ+YeLXtaA=
Ers0rc50nbjso0jbdZTmBw==
XQxVP45+F5OZn3ZBTC7MLe1OF3G5c5uK9A==
RHh4uwtsttjzlxy+eW3+
W+xQshfnvmF5n5x2d+cEVdBNIkQRHRE=
FwlyiuXNX0+Trw==
euLn91on/7DeDe++zbQ4YeLXtaA=
td4cO8m3HDRWtl8p7Q==
ZrlyAAPqc3GXI5k=
OM0IisKOI78FJC/IuIxxAu5nRg==
d6A0QJ6PV+AOpyK+eW3+
+EgxFWUu3Ulatl8p7Q==
GC/stck1ILXn+cWZx7w8W6rPFmO6c5uK9A==
hhIiK4+CKEOfB4tr
mA1pyQ85ye8N
4xgWYcEpEoidv8eXKNncAQ==
L+hOVbe+IWyc8oVUclc=
J7EGaJ+L+wKLXUYg7w==
L5R/nfdgQdMHD+TUKw1Zo3Hb
E4z2kWG/vE6yt5E=
+efGEVp82EycSL2U4cpFU2an/aM5SDuF
6zA2kAqIdAQKkve6y7RjtRBf+i8Nvw==
VRqXzvXLVF+hS9arybBihGeOTaKP
PgKByBDCpL4cd9+yO52n/xZmQZeF
pMit5lre4GVyi3xcfywQY58=
F/vD9x4Oz0RWtl8p7Q==
hvZhvTgp/H7Lm2RNdl0=
h/xWhNLDOEpSZUTmIguoBA==
o8qw6kCdiDV4kn1FMZ6et06V+dCQZEmG
bgMOGYox8vMQ
YmFKj+ZWVRBcep49cl0=
Wox2hOnIRnGp3s2RMZ9Zo3Hb
eeTk5zCrpCpSyntTeF0=
FOA7J3NsxuomwEARYVLNU1TR
yuLXKrWb72SKrA==
K6T6LoiKKwZrHY5i
B8UkEkol7nBvrLeOjSwQY58=
GwvWc8gVAk6yt5E=
4IboPYD24Hqi5mxf+g==
L4XQI2A00QtXxxi+eW3+
doMqp/ZMkE6yt5E=
1ebXKoTs0GSYqMZZc1U=
CYnoUKIiG5vI4/HHLNXpCw==
P/FwuirU0FeJxseeKNncAQ==
N21GaMlCYhFbtl8p7Q==
KY95j+NDjk6yt5E=
C/rJL7ACO0yfB4tr
z6QDKYo85+nxAx+zmTgBLYY=
IPBjddXCgzlvd2Y/C3KaMomhUQ==
KNsyKXJjN+wYPi8OLgNZo3Hb
kht0meHAHPpzqQ==
Rm5BMnxa1/s/yxq2wSJcfpc=
+Tn9l2Ax8vMQ
rwkQV4ruG7v1/s+ZKNncAQ==
7+RhcuhVYBpggr5YZUw=
YRaX4klS4xWfB4tr
YIZ5wgZjYOsslloz9A==
+SAdmP/smDZ6oKF4GxNZo3Hb
mSIWBEa/uz9JSodz
PGc0UrsbRk1LwHVWOp+9CQ==
DnJQctQ5jE6yt5E=
gYmlw+nLOxtYl4k=
eRJtqhQDH3KQsg==
brainbookgroup.com
Targets
-
-
Target
4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2
-
Size
768KB
-
MD5
60faea31bf224b220204dc167f1418f8
-
SHA1
7849870bd13daf80db63e11cc70b9082b427b60f
-
SHA256
4e55b2ec6600966189f48318f557e66a9197b0192e7c24b793f5bbd8116baae2
-
SHA512
5870abc4939556654b60e538bfea254d83f6263a53434dda1c71bf09844dc0b6e146c1d943f8faedc66ae6b55c8e89df228a46337806ba0bb445c8a2ee4a5944
-
SSDEEP
12288:Zlm8oGNXxAKz3SiHxTqlC9KVlLaS0tZIANC2qywKHzAcCcu98sDa:bxoqxAKrSiHhqlC9yOHWUqybzYT9FD
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-