Behavioral task
behavioral1
Sample
2023-04-24_b5bfda7a0c9649a87a78ade017633b53_kovter.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023-04-24_b5bfda7a0c9649a87a78ade017633b53_kovter.exe
Resource
win10v2004-20230221-en
General
-
Target
2023-04-24_b5bfda7a0c9649a87a78ade017633b53_kovter
-
Size
880KB
-
MD5
b5bfda7a0c9649a87a78ade017633b53
-
SHA1
5bd85f807985410669928062035fbf4c2bdbae0c
-
SHA256
0123ad24de3c84618c10efcf1e6c391febe8c6f352be31bbc58f616105172838
-
SHA512
21a0aa82a59e2112369a940d89fa91619ba3e91d65d11f74146546b0c631fe2cf17c37c51efa9a8c649e3c61b401063dcdfc6b20809bb434eef60daf02f2923b
-
SSDEEP
24576:Rc8FU91pTI8iYmE1qsopAFPfCZS5b9T7GqSV:Rc8FS1KtYR1qXpAFyZ4b9TSqS
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2023-04-24_b5bfda7a0c9649a87a78ade017633b53_kovter
Files
-
2023-04-24_b5bfda7a0c9649a87a78ade017633b53_kovter.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 366KB - Virtual size: 365KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ