General
-
Target
13b3997048b8456c35b752b35e84b748930cec0a6157e635db78e99f0e8d199d
-
Size
326KB
-
Sample
240501-xllh1sdg8x
-
MD5
7c913d55356b0cc422992f5b74733523
-
SHA1
b85ba639999704d3e712a4f38fded2f2af7ba672
-
SHA256
13b3997048b8456c35b752b35e84b748930cec0a6157e635db78e99f0e8d199d
-
SHA512
5601bd4cccc69d57fc1249c09d45ebca285eb44d12d694bfa67901468f50b2ea56f3d72845681dbd6c4178984a71078cca4908fdf0404266b581b67259738d78
-
SSDEEP
3072:Ie2A0wxDqUpM5scww4chO+O1BmP5DG0sg3i4XZ9WvDZHwdRX/L+gP38XV:IsxD5cwohO+O1sVG0/pZ6iPC8
Behavioral task
behavioral1
Sample
13b3997048b8456c35b752b35e84b748930cec0a6157e635db78e99f0e8d199d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
13b3997048b8456c35b752b35e84b748930cec0a6157e635db78e99f0e8d199d.exe
Resource
win10v2004-20240419-en
Malware Config
Targets
-
-
Target
13b3997048b8456c35b752b35e84b748930cec0a6157e635db78e99f0e8d199d
-
Size
326KB
-
MD5
7c913d55356b0cc422992f5b74733523
-
SHA1
b85ba639999704d3e712a4f38fded2f2af7ba672
-
SHA256
13b3997048b8456c35b752b35e84b748930cec0a6157e635db78e99f0e8d199d
-
SHA512
5601bd4cccc69d57fc1249c09d45ebca285eb44d12d694bfa67901468f50b2ea56f3d72845681dbd6c4178984a71078cca4908fdf0404266b581b67259738d78
-
SSDEEP
3072:Ie2A0wxDqUpM5scww4chO+O1BmP5DG0sg3i4XZ9WvDZHwdRX/L+gP38XV:IsxD5cwohO+O1sVG0/pZ6iPC8
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Detects Windows executables referencing non-Windows User-Agents
-
ModiLoader Second Stage
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-