General
-
Target
10bbd8c63401688caa6c916fa94d6e5b1f880b8bf52267aa02749a7988e7369d.zip
-
Size
319KB
-
Sample
230321-qn72gaad88
-
MD5
2a76b648fc325aae36dba70136b632ad
-
SHA1
bd9417cb9b4f94eb878bfe317561a5686970d3c9
-
SHA256
df86b951296852ad2597b5d405000d69979ed8f83ad6d7cfe9e3f82169c1832b
-
SHA512
f39a9876729bc6052449781b725bfc5f3b3b7f55d19c15d6873ed0163fc4b35f23979fe4db0cc71dd0f0154b4117a7d195e4be42d3f151a5ffcb1e48d59cffda
-
SSDEEP
6144:gRHupXp3h53p0vB86pI17iuo0E6JiJVZdfZeNG8HIu8f1XsfiqXTK1nhxWIFU:0HIZR5r6K1VEpJx4Nu1XTqOVhxi
Static task
static1
Behavioral task
behavioral1
Sample
Pdygfcjfevthba.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Pdygfcjfevthba.exe
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
Pdygfcjfevthba.exe
-
Size
884KB
-
MD5
054d3ce0c0c82f28547112a82f8ea692
-
SHA1
8c088a60d8f7e66261cca8d4ccb384ea1d9ad2c4
-
SHA256
591ea8c06daef587f239bbaa3d29cb46ccba25ccba58c324441efbaf4c5eb5d8
-
SHA512
45978b98a401d90be5c0db269fb52abc11a185b2a0e68eafa1d4b6ecf830944b53d6d166fd8bee5b28088d48c2b521ad3968f4569025817fd67a88967c87aeab
-
SSDEEP
12288:Cb8A+lyMML0gN55kXFyqf0bGBvGoE3IhAf1nAhglR:C4ZzML0gN5WXFaK9GoEHf1nAhglR
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-