Overview

overview

10

Static

static

3

5b8ee62453...20.exe

windows7-x64

10

5b8ee62453...20.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5b8ee624533eb1d03a75434c844d2020

  • Size

    879KB

  • Sample

    240114-w72xfscehm

  • MD5

    5b8ee624533eb1d03a75434c844d2020

  • SHA1

    7e75be02565fa941adb52f285c6011dca1046895

  • SHA256

    b82eb14e16332ed4abdaf6acddf4914e014fd387420c5352b57327a6de138451

  • SHA512

    c200d7d0b155669c9b165b4eb6ac9f4e47c9f280e323b05be3f6ea114e0dda14b5d2b841e932037f67defc18f21c67ae97abd1f4b7d9dc2364f03e1927acd1b0

  • SSDEEP

    24576:AktzYJvF6LiD/iZ4Il10mOgiMSDVEk5Xfax604:AkhovD/iaIU0eVjCxA

Score
10/10
modiloaderevasiontrojan

Malware Config

Targets

    • Target

      5b8ee624533eb1d03a75434c844d2020

    • Size

      879KB

    • MD5

      5b8ee624533eb1d03a75434c844d2020

    • SHA1

      7e75be02565fa941adb52f285c6011dca1046895

    • SHA256

      b82eb14e16332ed4abdaf6acddf4914e014fd387420c5352b57327a6de138451

    • SHA512

      c200d7d0b155669c9b165b4eb6ac9f4e47c9f280e323b05be3f6ea114e0dda14b5d2b841e932037f67defc18f21c67ae97abd1f4b7d9dc2364f03e1927acd1b0

    • SSDEEP

      24576:AktzYJvF6LiD/iZ4Il10mOgiMSDVEk5Xfax604:AkhovD/iaIU0eVjCxA

    Score
    10/10
    modiloaderevasiontrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • ModiLoader Second Stage

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks