General

  • Target

    f1871002492bac5f786b08f4c3b53200_NEIKI

  • Size

    130KB

  • Sample

    240508-gx2flshb75

  • MD5

    f1871002492bac5f786b08f4c3b53200

  • SHA1

    21ff21621cb3b38db8113be274de925390d36354

  • SHA256

    4c7b9e3a3031e788964c0e377ebf1ce72453eddc65f3145e02c656588aa0a5c5

  • SHA512

    7cc2623e01dc75c8cf72a0bb1e4d51ee81baaf2710bfc8a8889b64e8c71da0225915cc8219aa5ed4bd24d28663dab0604cb991f9014daa760834566a194a91b4

  • SSDEEP

    1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmX:SKQJcinxphkG5Q6GdpIOkJHhKRyOXK

Malware Config

Targets

    • Target

      f1871002492bac5f786b08f4c3b53200_NEIKI

    • Size

      130KB

    • MD5

      f1871002492bac5f786b08f4c3b53200

    • SHA1

      21ff21621cb3b38db8113be274de925390d36354

    • SHA256

      4c7b9e3a3031e788964c0e377ebf1ce72453eddc65f3145e02c656588aa0a5c5

    • SHA512

      7cc2623e01dc75c8cf72a0bb1e4d51ee81baaf2710bfc8a8889b64e8c71da0225915cc8219aa5ed4bd24d28663dab0604cb991f9014daa760834566a194a91b4

    • SSDEEP

      1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmX:SKQJcinxphkG5Q6GdpIOkJHhKRyOXK

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks