General
-
Target
e2c55fe1fa14508206c5d8d051e96471f83e299bccabe23d972780e534a5ca18
-
Size
130KB
-
Sample
240429-drbq8agg5x
-
MD5
e262b7d18020a381ccdec70ada2931a4
-
SHA1
6aef70ae70e72a8ab08609b328673bcb81d4edb3
-
SHA256
e2c55fe1fa14508206c5d8d051e96471f83e299bccabe23d972780e534a5ca18
-
SHA512
72aabb8c0030e51d42c447a4f89bcafd8512eba0a81e91d05b6e9f63d8c6bcfb1696440c8bb01f739c7fd2d079a31dc701c542c275652a7984b738e093a80484
-
SSDEEP
1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmZx:SKQJcinxphkG5Q6GdpIOkJHhKRyOXKz
Behavioral task
behavioral1
Sample
e2c55fe1fa14508206c5d8d051e96471f83e299bccabe23d972780e534a5ca18.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
e2c55fe1fa14508206c5d8d051e96471f83e299bccabe23d972780e534a5ca18.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
e2c55fe1fa14508206c5d8d051e96471f83e299bccabe23d972780e534a5ca18
-
Size
130KB
-
MD5
e262b7d18020a381ccdec70ada2931a4
-
SHA1
6aef70ae70e72a8ab08609b328673bcb81d4edb3
-
SHA256
e2c55fe1fa14508206c5d8d051e96471f83e299bccabe23d972780e534a5ca18
-
SHA512
72aabb8c0030e51d42c447a4f89bcafd8512eba0a81e91d05b6e9f63d8c6bcfb1696440c8bb01f739c7fd2d079a31dc701c542c275652a7984b738e093a80484
-
SSDEEP
1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmZx:SKQJcinxphkG5Q6GdpIOkJHhKRyOXKz
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Detects Windows executables referencing non-Windows User-Agents
-
ModiLoader Second Stage
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-