General

  • Target

    de0b8f3e305328be28104b616c2712b0

  • Size

    1.2MB

  • Sample

    240325-pzhehsfh94

  • MD5

    de0b8f3e305328be28104b616c2712b0

  • SHA1

    9276e68c3b042eeb62db65ea70175c4f3c92cf51

  • SHA256

    026360ce5f9278b01838068c4977117d2ef8edbe07a54e0053d5b5fea7a4cb0d

  • SHA512

    bbd18ebbfc6cfa32331fa355f0d6007ad219ad0cf19a46e1899ecfcad11c1692b2130683786fad0c1d14eb240a2d67b3ca39f86642be8f065a6498c11d2c3287

  • SSDEEP

    24576:7OFe8ZB8OKW7GeFeoWwRJviSJYcLvLT+6Kp3g82FuAP:7VW7vfFo3v2F9

Malware Config

Targets

    • Target

      de0b8f3e305328be28104b616c2712b0

    • Size

      1.2MB

    • MD5

      de0b8f3e305328be28104b616c2712b0

    • SHA1

      9276e68c3b042eeb62db65ea70175c4f3c92cf51

    • SHA256

      026360ce5f9278b01838068c4977117d2ef8edbe07a54e0053d5b5fea7a4cb0d

    • SHA512

      bbd18ebbfc6cfa32331fa355f0d6007ad219ad0cf19a46e1899ecfcad11c1692b2130683786fad0c1d14eb240a2d67b3ca39f86642be8f065a6498c11d2c3287

    • SSDEEP

      24576:7OFe8ZB8OKW7GeFeoWwRJviSJYcLvLT+6Kp3g82FuAP:7VW7vfFo3v2F9

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks