General
-
Target
846fd3710c0b4db09ae25fb5c84576ad
-
Size
253KB
-
Sample
240131-pvpyssebgl
-
MD5
846fd3710c0b4db09ae25fb5c84576ad
-
SHA1
aacbc7ecee2d5ecc085e377b2268529d635f2622
-
SHA256
d28a875080da98b1505131147d9bf1c6a5535b021e27ad55cac13a3be30a80c4
-
SHA512
75a13b6e59b0c631854717ac042b2387f9189af547c7c7b5df2b5a24f7b167d64e212f9b0cbc601436a06006d906fa4bcff07b44231b831ee7855b33b92a402c
-
SSDEEP
6144:n3OrIU2ykH2ipsPnafFlerkb3LrtoestXgNe9:n3OrIjXnOitlt3Noesdq
Static task
static1
Behavioral task
behavioral1
Sample
846fd3710c0b4db09ae25fb5c84576ad.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
846fd3710c0b4db09ae25fb5c84576ad.exe
Resource
win10v2004-20231222-en
Malware Config
Targets
-
-
Target
846fd3710c0b4db09ae25fb5c84576ad
-
Size
253KB
-
MD5
846fd3710c0b4db09ae25fb5c84576ad
-
SHA1
aacbc7ecee2d5ecc085e377b2268529d635f2622
-
SHA256
d28a875080da98b1505131147d9bf1c6a5535b021e27ad55cac13a3be30a80c4
-
SHA512
75a13b6e59b0c631854717ac042b2387f9189af547c7c7b5df2b5a24f7b167d64e212f9b0cbc601436a06006d906fa4bcff07b44231b831ee7855b33b92a402c
-
SSDEEP
6144:n3OrIU2ykH2ipsPnafFlerkb3LrtoestXgNe9:n3OrIjXnOitlt3Noesdq
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Adds policy Run key to start application
-
Modifies Installed Components in the registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-