Behavioral task
behavioral1
Sample
2023-05-19_ab5873e5854a511ff20747d851205165_kovter.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023-05-19_ab5873e5854a511ff20747d851205165_kovter.exe
Resource
win10v2004-20230220-en
General
-
Target
2023-05-19_ab5873e5854a511ff20747d851205165_kovter
-
Size
426KB
-
MD5
ab5873e5854a511ff20747d851205165
-
SHA1
1fd9db0835dded8d57fe4af8ad7c48a6a48af761
-
SHA256
91531ae4c4d272a01ab179fe874920d617a039dad28327778bab4f65576cc5e8
-
SHA512
2cba2580f5ae378fd80897a5b1f28a02c2e60da05a3a8832c8b1060ea30211a8744393777fe5bfbe90edf7a9a80ec4b68816da957c6030650d4deb38b25a3fa2
-
SSDEEP
6144:YSL8Xxa/EsOKGkmwCHQbTrt/uoeTDa4M5qwaLbSUFdtYoWKK2i1J0C6+v8BW5:PV/zPGFVHy55cRLtYoWSiA8
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-05-19_ab5873e5854a511ff20747d851205165_kovter
Files
-
2023-05-19_ab5873e5854a511ff20747d851205165_kovter.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 366KB - Virtual size: 365KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ