General
-
Target
a6d6955a903cf0b877bdbf037eec9bfdaf83c861b3ce0f2a0aad1bad4ad279bc
-
Size
112KB
-
Sample
240430-bes4maga7t
-
MD5
b4bc66bfd595946a719eebfcbafb9336
-
SHA1
cde56482ab6e95b52e79c64a20691d8d74f85d43
-
SHA256
a6d6955a903cf0b877bdbf037eec9bfdaf83c861b3ce0f2a0aad1bad4ad279bc
-
SHA512
ed7b7e1c9381c0950cb1f2bfed1907d4608ff6b9bc4bb9f7e09661b804c2f0bd635b18dd1f756b2e39806f6ae735e9c44c79e68a517f1a6fbfecab5071e7cda9
-
SSDEEP
1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5
Static task
static1
Behavioral task
behavioral1
Sample
a6d6955a903cf0b877bdbf037eec9bfdaf83c861b3ce0f2a0aad1bad4ad279bc.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a6d6955a903cf0b877bdbf037eec9bfdaf83c861b3ce0f2a0aad1bad4ad279bc.exe
Resource
win10v2004-20240419-en
Malware Config
Targets
-
-
Target
a6d6955a903cf0b877bdbf037eec9bfdaf83c861b3ce0f2a0aad1bad4ad279bc
-
Size
112KB
-
MD5
b4bc66bfd595946a719eebfcbafb9336
-
SHA1
cde56482ab6e95b52e79c64a20691d8d74f85d43
-
SHA256
a6d6955a903cf0b877bdbf037eec9bfdaf83c861b3ce0f2a0aad1bad4ad279bc
-
SHA512
ed7b7e1c9381c0950cb1f2bfed1907d4608ff6b9bc4bb9f7e09661b804c2f0bd635b18dd1f756b2e39806f6ae735e9c44c79e68a517f1a6fbfecab5071e7cda9
-
SSDEEP
1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Detects Windows executables referencing non-Windows User-Agents
-
ModiLoader Second Stage
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-