Behavioral task
behavioral1
Sample
2023-08-27_45e243518c401c5e46316a4cd0a49973_kovter_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-27_45e243518c401c5e46316a4cd0a49973_kovter_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-27_45e243518c401c5e46316a4cd0a49973_kovter_JC.exe
-
Size
426KB
-
MD5
45e243518c401c5e46316a4cd0a49973
-
SHA1
c18a5c4573076f1a64dbd6b8faa548218922e18c
-
SHA256
d597b6bbcd910a7349a9ee7fc887f1c9f684138805c4d54b38d1a0b8a58bb59a
-
SHA512
c0f9fe9ca8aee481f33be968a0ee8f5d65225c7ca34344fb774847d97f9372bb414eb4b00a513ef28ba51e1acd4681431abaf7a8319281791a720029621e4ff4
-
SSDEEP
6144:oZ/w8PoA8hLC5tgCnsTfZ7JW+cmypXUWRNODmI4o/65BSgL0aa7q+vzjTq:oZhgAUO5u4A5yhUWamIFcMgLYvq
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-08-27_45e243518c401c5e46316a4cd0a49973_kovter_JC.exe
Files
-
2023-08-27_45e243518c401c5e46316a4cd0a49973_kovter_JC.exe.exe windows:1 windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 366KB - Virtual size: 365KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ