modiloader | 829523583b0554ecaa134013f5ab6c97

Sharing

Copy URL Twitter E-mail

General

Target
829523583b0554ecaa134013f5ab6c97
Size 166KB
Sample240130-ya7sjsbdg8
SHA256 fc85a64f454f19e86252698d929de4bb28af7bb02ad505f0c3406b2bbdcbe29a
MD5 829523583b0554ecaa134013f5ab6c97
SHA1 030c0576d1cf50a9f33b5dca7e6ab091a6014b12
SHA512 262253197b46025a665677bdf1f629c7958df93080e71af22018064d85ab6ef482ee3483bbeba02310d3ae631c36fae571cb6a3e4fae7807bdf12e40c7d0a6b1
SSDEEP 3072:QxiYwPo1stN+tCAZIZiwGnLXndHVc+8dstVwurQoW+RrYVZALGYjIIID/1ygIIKG:Qxipg1YNmsZCe+8dstVwuUoWgrY6G/k4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
829523583b0554ecaa134013f5ab6c97

File Explorer

829523583b0554ecaa134013f5ab6c97

.exe 166KB

829523583b0554ecaa134013f5ab6c97

SHA256 fc85a64f454f19e86252698d929de4bb28af7bb02ad505f0c3406b2bbdcbe29a
MD5 829523583b0554ecaa134013f5ab6c97
SHA1 030c0576d1cf50a9f33b5dca7e6ab091a6014b12
SHA512 262253197b46025a665677bdf1f629c7958df93080e71af22018064d85ab6ef482ee3483bbeba02310d3ae631c36fae571cb6a3e4fae7807bdf12e40c7d0a6b1
SSDEEP 3072:QxiYwPo1stN+tCAZIZiwGnLXndHVc+8dstVwurQoW+RrYVZALGYjIIID/1ygIIKG:Qxipg1YNmsZCe+8dstVwuUoWgrY6G/k4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ModiLoader Second Stage
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

94608

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

111KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

12B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

829523583b0554ecaa134013f5ab6c97

generic