General

  • Target

    e2c55fe1fa14508206c5d8d051e96471f83e299bccabe23d972780e534a5ca18

  • Size

    130KB

  • Sample

    240429-drbq8agg5x

  • MD5

    e262b7d18020a381ccdec70ada2931a4

  • SHA1

    6aef70ae70e72a8ab08609b328673bcb81d4edb3

  • SHA256

    e2c55fe1fa14508206c5d8d051e96471f83e299bccabe23d972780e534a5ca18

  • SHA512

    72aabb8c0030e51d42c447a4f89bcafd8512eba0a81e91d05b6e9f63d8c6bcfb1696440c8bb01f739c7fd2d079a31dc701c542c275652a7984b738e093a80484

  • SSDEEP

    1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmZx:SKQJcinxphkG5Q6GdpIOkJHhKRyOXKz

Malware Config

Targets

    • Target

      e2c55fe1fa14508206c5d8d051e96471f83e299bccabe23d972780e534a5ca18

    • Size

      130KB

    • MD5

      e262b7d18020a381ccdec70ada2931a4

    • SHA1

      6aef70ae70e72a8ab08609b328673bcb81d4edb3

    • SHA256

      e2c55fe1fa14508206c5d8d051e96471f83e299bccabe23d972780e534a5ca18

    • SHA512

      72aabb8c0030e51d42c447a4f89bcafd8512eba0a81e91d05b6e9f63d8c6bcfb1696440c8bb01f739c7fd2d079a31dc701c542c275652a7984b738e093a80484

    • SSDEEP

      1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmZx:SKQJcinxphkG5Q6GdpIOkJHhKRyOXKz

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Detects Windows executables referencing non-Windows User-Agents

    • ModiLoader Second Stage

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks