Behavioral task
behavioral1
Sample
2023-05-10_48c0b230a4c527a637ae6c38e0f8668b_kovter.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023-05-10_48c0b230a4c527a637ae6c38e0f8668b_kovter.exe
Resource
win10v2004-20230220-en
General
-
Target
2023-05-10_48c0b230a4c527a637ae6c38e0f8668b_kovter
-
Size
362KB
-
MD5
48c0b230a4c527a637ae6c38e0f8668b
-
SHA1
51f6aa3be01482fe38da6de72e51f07bc31cdad5
-
SHA256
a4b92cdccc7179c0896f4a743a6760d3915763ac6a4190e8c50bf21f169e83d7
-
SHA512
5787cca87612193e4938d07a92b0dccb4af970d47a9e106924597f1dd98eea656e56b9ab6dd256241ff4dfdc35641e68f72c3503184f0d3a8f6731849e9d9780
-
SSDEEP
6144:mz/RGq50cklA2RYkrqcuu8XxVy82BfzZNUS1r/2yC149u3QBqOFH:aGqehFnGVUB/2yC14c3rI
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-05-10_48c0b230a4c527a637ae6c38e0f8668b_kovter
Files
-
2023-05-10_48c0b230a4c527a637ae6c38e0f8668b_kovter.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 306KB - Virtual size: 305KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 18KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ