Behavioral task
behavioral1
Sample
2023-05-10_9fd60923bc77b1823ce44a0e4cc86bf7_kovter.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023-05-10_9fd60923bc77b1823ce44a0e4cc86bf7_kovter.exe
Resource
win10v2004-20230220-en
General
-
Target
2023-05-10_9fd60923bc77b1823ce44a0e4cc86bf7_kovter
-
Size
362KB
-
MD5
9fd60923bc77b1823ce44a0e4cc86bf7
-
SHA1
47f90e02d24c822c6e208e4e1bdd0dde87cc8bd4
-
SHA256
39e339c4d74fc0369d8dd0c50093f28127e19e2d66856a02cbfca55e9d0aa61f
-
SHA512
2e0e215ae3c8d9c8da417fc8dc6a51b4177e263c4cabb55ef590793c6cbe7e1f02785fff7750836da5b3cba5045575c166c29661be9da1b19d39f96fc0ec08b0
-
SSDEEP
6144:UqIhOHa2cmG0LZ0Uk376EyMkRt7OI7RFHzfId2/BjHeSJAUQdq6dw:9C4lXSCtN7rBjH6U/H
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-05-10_9fd60923bc77b1823ce44a0e4cc86bf7_kovter
Files
-
2023-05-10_9fd60923bc77b1823ce44a0e4cc86bf7_kovter.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 306KB - Virtual size: 305KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 18KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ