General
-
Target
3c5e883513f7391c6e27923beaa6a6e90846ee5cb13b7c31570d5c10a944a75c
-
Size
308KB
-
Sample
240424-slwxjacb78
-
MD5
8131b3e9b26f0df46c846b7ad00e2cd5
-
SHA1
be90eae1ea44ef6547f75331a36f751e65aaeea5
-
SHA256
3c5e883513f7391c6e27923beaa6a6e90846ee5cb13b7c31570d5c10a944a75c
-
SHA512
fdbb05a5674591360046ada3b5c8bf7d8bb41b130ac1d43f48080b26a99380972e4f80c5891464c6532fd62caede6dcedb87cc68d97a8034441835af6655c8f0
-
SSDEEP
3072:/c3sBG7mXh7m/zZM3jAbNOM6CNtDCZFL:E3sBz0Z4Mj72F
Static task
static1
Behavioral task
behavioral1
Sample
3c5e883513f7391c6e27923beaa6a6e90846ee5cb13b7c31570d5c10a944a75c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3c5e883513f7391c6e27923beaa6a6e90846ee5cb13b7c31570d5c10a944a75c.exe
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
3c5e883513f7391c6e27923beaa6a6e90846ee5cb13b7c31570d5c10a944a75c
-
Size
308KB
-
MD5
8131b3e9b26f0df46c846b7ad00e2cd5
-
SHA1
be90eae1ea44ef6547f75331a36f751e65aaeea5
-
SHA256
3c5e883513f7391c6e27923beaa6a6e90846ee5cb13b7c31570d5c10a944a75c
-
SHA512
fdbb05a5674591360046ada3b5c8bf7d8bb41b130ac1d43f48080b26a99380972e4f80c5891464c6532fd62caede6dcedb87cc68d97a8034441835af6655c8f0
-
SSDEEP
3072:/c3sBG7mXh7m/zZM3jAbNOM6CNtDCZFL:E3sBz0Z4Mj72F
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Detects Windows executables referencing non-Windows User-Agents
-
ModiLoader Second Stage
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-