General
-
Target
863aa7600167704c4c8f6f73118584e0_NEAS
-
Size
90KB
-
Sample
240507-pzct2aah63
-
MD5
863aa7600167704c4c8f6f73118584e0
-
SHA1
d9ca386c22f0fb5400a8b92e94012822ec6926d0
-
SHA256
a25d757e31be69503740505aa15e3535499d17669b104b91ab191b434f957abf
-
SHA512
81eed09a5f4ae8f951938d2b4f67cfbd29f89aa681294ed5ccd968815c8ce3601b4f1e24872c914a7745856bde88e1f5446d93da01cb51c6dfc6cc6045350b64
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Behavioral task
behavioral1
Sample
863aa7600167704c4c8f6f73118584e0_NEAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
863aa7600167704c4c8f6f73118584e0_NEAS.exe
Resource
win10v2004-20240419-en
Malware Config
Targets
-
-
Target
863aa7600167704c4c8f6f73118584e0_NEAS
-
Size
90KB
-
MD5
863aa7600167704c4c8f6f73118584e0
-
SHA1
d9ca386c22f0fb5400a8b92e94012822ec6926d0
-
SHA256
a25d757e31be69503740505aa15e3535499d17669b104b91ab191b434f957abf
-
SHA512
81eed09a5f4ae8f951938d2b4f67cfbd29f89aa681294ed5ccd968815c8ce3601b4f1e24872c914a7745856bde88e1f5446d93da01cb51c6dfc6cc6045350b64
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-