Extracted

Extracted

• • Target

    dca9c0d5b10ab8b01e4e60cfb4fb11f858d8c4c3d92ca2f20d80ae78b138f915.lnk

  • Size

    528KB

  • MD5

    bf42189c53d02d4618030d75659296f3

  • SHA1

    bbff2942b885222d450c1579ca807faf6ffdbc42

  • SHA256

    dca9c0d5b10ab8b01e4e60cfb4fb11f858d8c4c3d92ca2f20d80ae78b138f915

  • SHA512

    f73042e3e0840c64952b0ccd7c32d6b3037fce0a3d2488032af799e48de5c4568865cc3a6fd2db00db83693661f70eca8e1548aa69acceca02ffc2b7af5b351d

  • SSDEEP

    12:8MMlHm/3BVSXvk4RnK9hRNSWhW+UcZRNS/De9DGvAl7DiNL4t2YqlsXSkgK:8lo/ByKn8+/lMAyvAl7a5/Mhg

  Score

  10^/10

  modiloadervidarc24cebaf477b8a7988497cf94e898888discoveryevasionspywarestealertrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • UAC bypass

    evasiontrojan

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • ModiLoader Second Stage

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2