modiloader | 2023-05-19_f50d51d0805ec9259c742a11d39dce36_kovter | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2023-05-19_f50d51d0805ec9259c742a11d39dce36_kovter
Size

426KB
MD5

f50d51d0805ec9259c742a11d39dce36
SHA1

720fa979fa38fcfc9a8ab93fbdfbb9bec3e3057a
SHA256

3be307f3c35da3376bd43aadbe22f0678821fbe152833a49d5a31a18f563f6a0
SHA512

26d97ed81101f31a3843767cdab427a9ced53f5e9b5b7f33ceb8012296b3c2191875bbced2802db8e35b2b3a813a487358ca99aea1caf5a291b2cfdcb7ddf41e
SSDEEP

6144:Sn4CPMYOHfbUHyIJsBp2aJjryPXECrhITLeIgrOwhl8QOsLg8Aea+vzjTW4:Sj0YOHfbUSM+24yPEChIveIFQusLtvh

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2023-05-19_f50d51d0805ec9259c742a11d39dce36_kovter

Files

2023-05-19_f50d51d0805ec9259c742a11d39dce36_kovter
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 366KB - Virtual size: 365KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ