General

  • Target

    f919854b3001adc116c075f10944c865d19a6384c008e565399f07a2fb7f02f1

  • Size

    90KB

  • Sample

    240429-ep1s1ahf89

  • MD5

    3f08eb776f7d4879010f4d9dd63c59e4

  • SHA1

    8020cdb628f74232172d758cae9854a81651e103

  • SHA256

    f919854b3001adc116c075f10944c865d19a6384c008e565399f07a2fb7f02f1

  • SHA512

    3d56801da9605b016e1497629e2b569df15fa2c12c659c6be3b4c89a94c2599d69aed9bb6d218562af9d5bce733adbf4dd248a0d8a0e5b37e1f57730e38eed2f

  • SSDEEP

    1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y

Malware Config

Targets

    • Target

      f919854b3001adc116c075f10944c865d19a6384c008e565399f07a2fb7f02f1

    • Size

      90KB

    • MD5

      3f08eb776f7d4879010f4d9dd63c59e4

    • SHA1

      8020cdb628f74232172d758cae9854a81651e103

    • SHA256

      f919854b3001adc116c075f10944c865d19a6384c008e565399f07a2fb7f02f1

    • SHA512

      3d56801da9605b016e1497629e2b569df15fa2c12c659c6be3b4c89a94c2599d69aed9bb6d218562af9d5bce733adbf4dd248a0d8a0e5b37e1f57730e38eed2f

    • SSDEEP

      1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Detects Windows executables referencing non-Windows User-Agents

    • ModiLoader Second Stage

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks