General
-
Target
Invfile2123.exe
-
Size
1.8MB
-
Sample
231122-3by91sfa99
-
MD5
dec4ccba06b7143d469d26429c594628
-
SHA1
07f913848dca98bf567454c6ffd1c2740f3b3e08
-
SHA256
8f3abc8783e372932f05def9c6d3270b5d72982115551806a5dac2d8aacc2458
-
SHA512
e702cfb0f7b63258b841778fba754e2e23eaf16e4c11834e8b4dbd03a19dc811b6475dcc7cbda770f4c8a8563c37efc0ee4b960d9c8dda30a24881b9fc983fb3
-
SSDEEP
49152:aD4+yRMXpcOX8IxTqh0eJa3DZEe9sRuCVCW4rMyqChsyfue9T:aDqRMXpcOXX8Za31CuCc/MXC+yf
Static task
static1
Behavioral task
behavioral1
Sample
Invfile2123.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Invfile2123.exe
Resource
win10v2004-20231020-en
Malware Config
Extracted
remcos
babbalog
mxzaa.duckdns.org:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
babaa
-
mouse_option
false
-
mutex
Rmc-17YJIC
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
Invfile2123.exe
-
Size
1.8MB
-
MD5
dec4ccba06b7143d469d26429c594628
-
SHA1
07f913848dca98bf567454c6ffd1c2740f3b3e08
-
SHA256
8f3abc8783e372932f05def9c6d3270b5d72982115551806a5dac2d8aacc2458
-
SHA512
e702cfb0f7b63258b841778fba754e2e23eaf16e4c11834e8b4dbd03a19dc811b6475dcc7cbda770f4c8a8563c37efc0ee4b960d9c8dda30a24881b9fc983fb3
-
SSDEEP
49152:aD4+yRMXpcOX8IxTqh0eJa3DZEe9sRuCVCW4rMyqChsyfue9T:aDqRMXpcOXX8Za31CuCc/MXC+yf
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-