Behavioral task
behavioral1
Sample
a597d34bc2464c3ace48ac04f6653f65ac4822ea8e4a5717ba9e4909b8c62240.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
a597d34bc2464c3ace48ac04f6653f65ac4822ea8e4a5717ba9e4909b8c62240.exe
Resource
win10v2004-20230220-en
General
-
Target
de74e1eb8ca5494496632da478851ade.bin
-
Size
210KB
-
MD5
4e0f87c32e548590fa027b5383484f7d
-
SHA1
f6350155c28ceaa37acf723408f943d700d71eb6
-
SHA256
7eeba43dd7280830318a260728ef40d6ed616be384dc075178406b3d30394517
-
SHA512
6acc88507bd507984920ad04fb3acf2998d41065e920b437e780e0c93f04fcf38ceed69c2b01accef3538aa637667c016ee00df9db798997fb9ad30ff0da8c63
-
SSDEEP
3072:8MauHjzlxTe4CjnkSJdsHxKuq+HA4oohVUlHRKj5WSdpPmsGgJK2KJ3TpVQ6n/oW:3auXl4pFGdlHbooPt5Wb9E+/Rf
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule static1/unpack001/a597d34bc2464c3ace48ac04f6653f65ac4822ea8e4a5717ba9e4909b8c62240.exe modiloader_stage2 -
Modiloader family
Files
-
de74e1eb8ca5494496632da478851ade.bin.zip
Password: infected
-
a597d34bc2464c3ace48ac04f6653f65ac4822ea8e4a5717ba9e4909b8c62240.exe.exe windows x86
Password: infected
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 327KB - Virtual size: 327KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 18KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ