modiloader | 2023-05-10_4b9a25ef2f60cb1054141cce20968565_kovter | Triage

Sharing

General

Target

2023-05-10_4b9a25ef2f60cb1054141cce20968565_kovter
Size

362KB
MD5

4b9a25ef2f60cb1054141cce20968565
SHA1

863af28aec5537469e3ce00c3601bab2cc36fcc5
SHA256

2ce346440755bc5ef591dda83948a0e9fef88c7cd98424eb6b9920c1f4898d9a
SHA512

b5f5d25a28ac666f0452db6d317cae3931b66a3e13659b8315a7858b00ee867636245311fa7fceb7c9e5327d02488e92432ada166134571c9e15dbbef2386597
SSDEEP

6144:AxG3Il8Colji3sjP+kGyYSGC0Zn9gUb23RHzxKGpP/O7SLmzQRqQwN:j3I+blj5y9k3hO7SKznv

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2023-05-10_4b9a25ef2f60cb1054141cce20968565_kovter

Files

2023-05-10_4b9a25ef2f60cb1054141cce20968565_kovter
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 306KB - Virtual size: 305KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 18KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ