Behavioral task
behavioral1
Sample
2024-05-04_b21620605d46bbe0fdc77d32cebb10d0_kovter.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-04_b21620605d46bbe0fdc77d32cebb10d0_kovter.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-05-04_b21620605d46bbe0fdc77d32cebb10d0_kovter
-
Size
800KB
-
MD5
b21620605d46bbe0fdc77d32cebb10d0
-
SHA1
a0fd3ad69483034a900b87d94fc5a50cebac6b3c
-
SHA256
0bad6e7960cc8aa21d34f0b461d0024211556bf0093f7a9d010f0f153f3dd45b
-
SHA512
9d47560fa372b31a9e00b52c95173219e948be6667858252875d68f77cc9f5d8805286f6a210ba7f85b80ca3048d62fb8148f9933bc2c14c909dd6b15062e712
-
SSDEEP
12288:sRmeqWpCLLqh5pCv63U5mYouagDPgNHSwAYPeneP:imeqWpCLs58C3U5mLuagDINywBPeneP
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
resource yara_rule sample modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-04_b21620605d46bbe0fdc77d32cebb10d0_kovter
Files
-
2024-05-04_b21620605d46bbe0fdc77d32cebb10d0_kovter.exe windows:0 windows x64 arch:x64
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 800KB - Virtual size: 800KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ