Overview

overview

10

Static

static

10

1fedfc97d5...a8.exe

windows7-x64

10

1fedfc97d5...a8.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1fedfc97d52dc13ed6cebde7519bf7a8

  • Size

    730KB

  • Sample

    231225-bn94haabc2

  • MD5

    1fedfc97d52dc13ed6cebde7519bf7a8

  • SHA1

    a5586c63c2e4eb65ce4c3f1a3070e7e01fbba470

  • SHA256

    4851611ebb2a33698be0ed454cbaf495d86925ef472c6cdc5b799e259c573b3c

  • SHA512

    aa67f72731ff7045ae899d4ba2cf861149c8524c92e38de2eee0bb707745a87bff6a0c7210abdf3a3ebfb49e3d34edec4588f3ba167368c8a8b64a311aaa829e

  • SSDEEP

    12288:Y9nTQAiVtuiwlF4w+dGnS0LzPgm8cryDYTS7b9ihfJEdp86nH3UqCILs9:Y9nNMmlyeS0LzgsryuS7b9ihz6Ox

Score
10/10
modiloaderpersistencetrojan

Malware Config

Targets

    • Target

      1fedfc97d52dc13ed6cebde7519bf7a8

    • Size

      730KB

    • MD5

      1fedfc97d52dc13ed6cebde7519bf7a8

    • SHA1

      a5586c63c2e4eb65ce4c3f1a3070e7e01fbba470

    • SHA256

      4851611ebb2a33698be0ed454cbaf495d86925ef472c6cdc5b799e259c573b3c

    • SHA512

      aa67f72731ff7045ae899d4ba2cf861149c8524c92e38de2eee0bb707745a87bff6a0c7210abdf3a3ebfb49e3d34edec4588f3ba167368c8a8b64a311aaa829e

    • SSDEEP

      12288:Y9nTQAiVtuiwlF4w+dGnS0LzPgm8cryDYTS7b9ihfJEdp86nH3UqCILs9:Y9nNMmlyeS0LzgsryuS7b9ihz6Ox

    Score
    10/10
    modiloaderpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks