General
-
Target
Specifications.exe
-
Size
37.2MB
-
Sample
230220-xs6sjadg9z
-
MD5
a2407b5450ae9e9c2e9cd2ce23b730f2
-
SHA1
050c50124c3728b8e32b1d0ee3ac7051ef062f72
-
SHA256
21586473125a0d4814ec8cfc1c09a310889f9f1fc9002eb75ff84e98fb4ff22a
-
SHA512
f82e2ab6dabf9491543b490f66a0f464edd17529e3b455364993094398d3423f73ef561082054ca2c176739f23d70bcd01d257bc4d967ab935ac44cecbff4809
-
SSDEEP
12288:59eu4QUqmzouRvfkK10/ngIlubJA7pXUKPpj1R8P/Wx5QblAc6FgMHOygt:59B4cuRHLkVS8pjTfzClp6FFu/
Static task
static1
Behavioral task
behavioral1
Sample
Specifications.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Specifications.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
remcos
Feb-AED-2023
pentester01.duckdns.org:53077
pentester0.accesscam.org:56796
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
WeTransfer.exe
-
copy_folder
WeTransfer
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
Wetransfer
-
mouse_option
false
-
mutex
Wtr-T1D6TL
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
WeTransfer
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
Specifications.exe
-
Size
37.2MB
-
MD5
a2407b5450ae9e9c2e9cd2ce23b730f2
-
SHA1
050c50124c3728b8e32b1d0ee3ac7051ef062f72
-
SHA256
21586473125a0d4814ec8cfc1c09a310889f9f1fc9002eb75ff84e98fb4ff22a
-
SHA512
f82e2ab6dabf9491543b490f66a0f464edd17529e3b455364993094398d3423f73ef561082054ca2c176739f23d70bcd01d257bc4d967ab935ac44cecbff4809
-
SSDEEP
12288:59eu4QUqmzouRvfkK10/ngIlubJA7pXUKPpj1R8P/Wx5QblAc6FgMHOygt:59B4cuRHLkVS8pjTfzClp6FFu/
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-