General

  • Target

    846fd3710c0b4db09ae25fb5c84576ad

  • Size

    253KB

  • Sample

    240131-pvpyssebgl

  • MD5

    846fd3710c0b4db09ae25fb5c84576ad

  • SHA1

    aacbc7ecee2d5ecc085e377b2268529d635f2622

  • SHA256

    d28a875080da98b1505131147d9bf1c6a5535b021e27ad55cac13a3be30a80c4

  • SHA512

    75a13b6e59b0c631854717ac042b2387f9189af547c7c7b5df2b5a24f7b167d64e212f9b0cbc601436a06006d906fa4bcff07b44231b831ee7855b33b92a402c

  • SSDEEP

    6144:n3OrIU2ykH2ipsPnafFlerkb3LrtoestXgNe9:n3OrIjXnOitlt3Noesdq

Malware Config

Targets

    • Target

      846fd3710c0b4db09ae25fb5c84576ad

    • Size

      253KB

    • MD5

      846fd3710c0b4db09ae25fb5c84576ad

    • SHA1

      aacbc7ecee2d5ecc085e377b2268529d635f2622

    • SHA256

      d28a875080da98b1505131147d9bf1c6a5535b021e27ad55cac13a3be30a80c4

    • SHA512

      75a13b6e59b0c631854717ac042b2387f9189af547c7c7b5df2b5a24f7b167d64e212f9b0cbc601436a06006d906fa4bcff07b44231b831ee7855b33b92a402c

    • SSDEEP

      6144:n3OrIU2ykH2ipsPnafFlerkb3LrtoestXgNe9:n3OrIjXnOitlt3Noesdq

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • ModiLoader Second Stage

    • Adds policy Run key to start application

    • Modifies Installed Components in the registry

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks