modiloader | dca9c0d5b10ab8b01e4e60cfb4fb11f858d8c4c3d92ca2f20d80ae78b138f915

General

Target

dca9c0d5b10ab8b01e4e60cfb4fb11f858d8c4c3d92ca2f20d80ae78b138f915.lnk
Size

528KB
Sample

230411-s1p3jadc85
MD5

bf42189c53d02d4618030d75659296f3
SHA1

bbff2942b885222d450c1579ca807faf6ffdbc42
SHA256

dca9c0d5b10ab8b01e4e60cfb4fb11f858d8c4c3d92ca2f20d80ae78b138f915
SHA512

f73042e3e0840c64952b0ccd7c32d6b3037fce0a3d2488032af799e48de5c4568865cc3a6fd2db00db83693661f70eca8e1548aa69acceca02ffc2b7af5b351d
SSDEEP

12:8MMlHm/3BVSXvk4RnK9hRNSWhW+UcZRNS/De9DGvAl7DiNL4t2YqlsXSkgK:8lo/ByKn8+/lMAyvAl7a5/Mhg

Score

10^/10

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://marcapinyo.ac.ug/url/knl/pay.hta

Extracted

Family

vidar

Version

3.4

Botnet

c24cebaf477b8a7988497cf94e898888

C2

https://steamcommunity.com/profiles/76561199494593681

https://t.me/auftriebs

Attributes

profile_id_v2
c24cebaf477b8a7988497cf94e898888
user_agent
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0

Targets

- Target
  
  dca9c0d5b10ab8b01e4e60cfb4fb11f858d8c4c3d92ca2f20d80ae78b138f915.lnk
- Size
  
  528KB
- MD5
  
  bf42189c53d02d4618030d75659296f3
- SHA1
  
  bbff2942b885222d450c1579ca807faf6ffdbc42
- SHA256
  
  dca9c0d5b10ab8b01e4e60cfb4fb11f858d8c4c3d92ca2f20d80ae78b138f915
- SHA512
  
  f73042e3e0840c64952b0ccd7c32d6b3037fce0a3d2488032af799e48de5c4568865cc3a6fd2db00db83693661f70eca8e1548aa69acceca02ffc2b7af5b351d
- SSDEEP
  
  12:8MMlHm/3BVSXvk4RnK9hRNSWhW+UcZRNS/De9DGvAl7DiNL4t2YqlsXSkgK:8lo/ByKn8+/lMAyvAl7a5/Mhg
Score

10^/10

modiloader vidar c24cebaf477b8a7988497cf94e898888 discovery evasion spyware stealer trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- UAC bypass
  evasion trojan
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- ModiLoader Second Stage
- Blocklisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2