General
-
Target
de0b8f3e305328be28104b616c2712b0
-
Size
1.2MB
-
Sample
240325-pzhehsfh94
-
MD5
de0b8f3e305328be28104b616c2712b0
-
SHA1
9276e68c3b042eeb62db65ea70175c4f3c92cf51
-
SHA256
026360ce5f9278b01838068c4977117d2ef8edbe07a54e0053d5b5fea7a4cb0d
-
SHA512
bbd18ebbfc6cfa32331fa355f0d6007ad219ad0cf19a46e1899ecfcad11c1692b2130683786fad0c1d14eb240a2d67b3ca39f86642be8f065a6498c11d2c3287
-
SSDEEP
24576:7OFe8ZB8OKW7GeFeoWwRJviSJYcLvLT+6Kp3g82FuAP:7VW7vfFo3v2F9
Behavioral task
behavioral1
Sample
de0b8f3e305328be28104b616c2712b0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
de0b8f3e305328be28104b616c2712b0.exe
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
de0b8f3e305328be28104b616c2712b0
-
Size
1.2MB
-
MD5
de0b8f3e305328be28104b616c2712b0
-
SHA1
9276e68c3b042eeb62db65ea70175c4f3c92cf51
-
SHA256
026360ce5f9278b01838068c4977117d2ef8edbe07a54e0053d5b5fea7a4cb0d
-
SHA512
bbd18ebbfc6cfa32331fa355f0d6007ad219ad0cf19a46e1899ecfcad11c1692b2130683786fad0c1d14eb240a2d67b3ca39f86642be8f065a6498c11d2c3287
-
SSDEEP
24576:7OFe8ZB8OKW7GeFeoWwRJviSJYcLvLT+6Kp3g82FuAP:7VW7vfFo3v2F9
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of SetThreadContext
-