General

  • Target

    6e350d1e48ed8f2515c30714db2343a2

  • Size

    202KB

  • Sample

    240122-ahrvascchk

  • MD5

    6e350d1e48ed8f2515c30714db2343a2

  • SHA1

    4dc58271ae88ccb0014a5dbe89583b96af0b4d0e

  • SHA256

    2da5fccb18e96468e1c327ae2d2dc072106dfd5f4e1f70ae71d10541221d5c22

  • SHA512

    38deabf8ff764c085ddb4fc135434b52627337df59c942ccbf7f423dc9abfa89a7057b32ac138f025325a54da2ff94fd44c2c077528ac81193f2876b728e2010

  • SSDEEP

    6144:Oz5qIMMQ7j7UGSaJxF+hzzyymJRJq6muwDGbFZAxNt+:aja7XmaJfemJRg6jwapZ

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      6e350d1e48ed8f2515c30714db2343a2

    • Size

      202KB

    • MD5

      6e350d1e48ed8f2515c30714db2343a2

    • SHA1

      4dc58271ae88ccb0014a5dbe89583b96af0b4d0e

    • SHA256

      2da5fccb18e96468e1c327ae2d2dc072106dfd5f4e1f70ae71d10541221d5c22

    • SHA512

      38deabf8ff764c085ddb4fc135434b52627337df59c942ccbf7f423dc9abfa89a7057b32ac138f025325a54da2ff94fd44c2c077528ac81193f2876b728e2010

    • SSDEEP

      6144:Oz5qIMMQ7j7UGSaJxF+hzzyymJRJq6muwDGbFZAxNt+:aja7XmaJfemJRg6jwapZ

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • ModiLoader Second Stage

    • Drops file in Drivers directory

    • Deletes itself

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks