modiloader | 2959bac05c60d3a75b28ef751a8308b61abe4c06c0692d14a167bd567e24654b

General

Target

2959bac05c60d3a75b28ef751a8308b61abe4c06c0692d14a167bd567e24654b
Size

1.6MB
Sample

240507-bywnvscd8v
MD5

d56b96a8200fd32fbb957aae4d5f1dcf
SHA1

dfe1622444f408b41ab226c69269176dcb7246eb
SHA256

2959bac05c60d3a75b28ef751a8308b61abe4c06c0692d14a167bd567e24654b
SHA512

88ef18694a6de802541644a5b63732848577f3d763453f3747b5105ab35711e17eb97c6758edfc843c3c5b795d6ad5a6f2e7bcbc84d3ab4f2e0fd2f06ab3413b
SSDEEP

49152:ay6imwGhfj4GBT2z95Zw/L+gwnzanwyuPTh:azimw4f8iSuD+g

Score

10^/10

Malware Config

Targets

- Target
  
  2959bac05c60d3a75b28ef751a8308b61abe4c06c0692d14a167bd567e24654b
- Size
  
  1.6MB
- MD5
  
  d56b96a8200fd32fbb957aae4d5f1dcf
- SHA1
  
  dfe1622444f408b41ab226c69269176dcb7246eb
- SHA256
  
  2959bac05c60d3a75b28ef751a8308b61abe4c06c0692d14a167bd567e24654b
- SHA512
  
  88ef18694a6de802541644a5b63732848577f3d763453f3747b5105ab35711e17eb97c6758edfc843c3c5b795d6ad5a6f2e7bcbc84d3ab4f2e0fd2f06ab3413b
- SSDEEP
  
  49152:ay6imwGhfj4GBT2z95Zw/L+gwnzanwyuPTh:azimw4f8iSuD+g
Score

10^/10

modiloader trojan zgrat execution persistence rat spyware stealer
- Detect ZGRat V1
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- ModiLoader Second Stage
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2