General
-
Target
8ed25678eb4189ced9460b859cfd1db8
-
Size
974KB
-
Sample
240204-lmvyasedd6
-
MD5
8ed25678eb4189ced9460b859cfd1db8
-
SHA1
46e9a6902889a8d01288e97d4acb7478385a5921
-
SHA256
8634df6a5cf7d39991b21b8cf1ac93643510689321ac681f9606188fdc87a13f
-
SHA512
adf9f745a49e38e25e423130af23f7a2c57f6744496f91ce6b979c5c06b1d722392baa196503e6ab57a85ecbab6d92bbacb79afbd54202d7efe75e5663d0af9b
-
SSDEEP
12288:LJhWMwb2tLcPuySgo2nYfJO0DbwfjkZuegQJ8g+Odzv9D09CIBr46IbTYI/Wsgh6:L9wb2twRD4UjkAegQq+1YNInYIlXbpd
Static task
static1
Behavioral task
behavioral1
Sample
8ed25678eb4189ced9460b859cfd1db8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8ed25678eb4189ced9460b859cfd1db8.exe
Resource
win10v2004-20231215-en
Malware Config
Targets
-
-
Target
8ed25678eb4189ced9460b859cfd1db8
-
Size
974KB
-
MD5
8ed25678eb4189ced9460b859cfd1db8
-
SHA1
46e9a6902889a8d01288e97d4acb7478385a5921
-
SHA256
8634df6a5cf7d39991b21b8cf1ac93643510689321ac681f9606188fdc87a13f
-
SHA512
adf9f745a49e38e25e423130af23f7a2c57f6744496f91ce6b979c5c06b1d722392baa196503e6ab57a85ecbab6d92bbacb79afbd54202d7efe75e5663d0af9b
-
SSDEEP
12288:LJhWMwb2tLcPuySgo2nYfJO0DbwfjkZuegQJ8g+Odzv9D09CIBr46IbTYI/Wsgh6:L9wb2twRD4UjkAegQq+1YNInYIlXbpd
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-