modiloader | 44ed87bca739bea9b8ac2521678b89a2721c828954ddb1e6ab0ea53dabee2571

General

Target

loader_1.exe
Size

50KB
Sample

230408-tfpfyaea39
MD5

935f44677afd746280af92052805793c
SHA1

f03b5a9eacf210fd38079c152b4399e6e2cfd9a5
SHA256

44ed87bca739bea9b8ac2521678b89a2721c828954ddb1e6ab0ea53dabee2571
SHA512

70df5585a576631f278ef619aa349088ad2d7aef99d9c028ebc24f29dfb7a71f4d0cd028dfb50eee332e870595586d67cb7166d7f1669759f818997daa98f4f5
SSDEEP

768:aKTeORI+AXZHpRrgBNFG6xJ65h0zb6bqaeHqrYAkCOoWyhiaJqXXt:aKhlAXXRrgBW5qzb6bqaeKrYAFOoXCN

Score

10^/10

Malware Config

Extracted

Family

xworm

C2

system-headed.at.ply.gg:7113

system-headed.at.ply.gg:1593

Attributes

install_file
USB.exe

Targets

- Target
  
  loader_1.exe
- Size
  
  50KB
- MD5
  
  935f44677afd746280af92052805793c
- SHA1
  
  f03b5a9eacf210fd38079c152b4399e6e2cfd9a5
- SHA256
  
  44ed87bca739bea9b8ac2521678b89a2721c828954ddb1e6ab0ea53dabee2571
- SHA512
  
  70df5585a576631f278ef619aa349088ad2d7aef99d9c028ebc24f29dfb7a71f4d0cd028dfb50eee332e870595586d67cb7166d7f1669759f818997daa98f4f5
- SSDEEP
  
  768:aKTeORI+AXZHpRrgBNFG6xJ65h0zb6bqaeHqrYAkCOoWyhiaJqXXt:aKhlAXXRrgBW5qzb6bqaeKrYAFOoXCN
Score

10^/10

modiloader xenarmor xworm collection password persistence ransomware rat recovery spyware stealer trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- XenArmor Suite
  XenArmor is as suite of password recovery tools for various application.
  recovery password xenarmor
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- ModiLoader Second Stage
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1