General
-
Target
960bea688cbe2f6decb6efa664efb8b1c32f34e3c8b8added1167a9fdf6fc3a7
-
Size
90KB
-
Sample
240504-a148cahb3x
-
MD5
c3e2153caa82f1662f0ee4fce86ec9ad
-
SHA1
dc185493143192a39a231ef5bea22632bca853b6
-
SHA256
960bea688cbe2f6decb6efa664efb8b1c32f34e3c8b8added1167a9fdf6fc3a7
-
SHA512
9acc96a17b95c2bcd3b50e6b0bc52a1768ff5083b8c9be63cbd83e372f1620fcc2078b19f13a6d15edec5419edadd57271cc617c7cafb8b99a98b71c2d067487
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Behavioral task
behavioral1
Sample
960bea688cbe2f6decb6efa664efb8b1c32f34e3c8b8added1167a9fdf6fc3a7.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
960bea688cbe2f6decb6efa664efb8b1c32f34e3c8b8added1167a9fdf6fc3a7.exe
Resource
win10v2004-20240419-en
Malware Config
Targets
-
-
Target
960bea688cbe2f6decb6efa664efb8b1c32f34e3c8b8added1167a9fdf6fc3a7
-
Size
90KB
-
MD5
c3e2153caa82f1662f0ee4fce86ec9ad
-
SHA1
dc185493143192a39a231ef5bea22632bca853b6
-
SHA256
960bea688cbe2f6decb6efa664efb8b1c32f34e3c8b8added1167a9fdf6fc3a7
-
SHA512
9acc96a17b95c2bcd3b50e6b0bc52a1768ff5083b8c9be63cbd83e372f1620fcc2078b19f13a6d15edec5419edadd57271cc617c7cafb8b99a98b71c2d067487
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Detects Windows executables referencing non-Windows User-Agents
-
ModiLoader Second Stage
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-