Overview

overview

10

Static

static

3

a53ed56299...cs.exe

windows7-x64

10

a53ed56299...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a53ed56299046d626f16964c38b67160_NeikiAnalytics

  • Size

    112KB

  • Sample

    240511-jzpwpsff8y

  • MD5

    a53ed56299046d626f16964c38b67160

  • SHA1

    933fa421e9ca31cd4c2a1a954921fbe887161eb2

  • SHA256

    7db74d3c79d6f8ece89fa9465393791c2f8b8f4974953373ba6733fa0ffcf8a3

  • SHA512

    f0fa707661a8d2c2101bca96af40e8a084fd99d11a66314d59c7a5edc824e491e6b404cfbc366f30eeba28159cc86342f5920707e796fe047971d54b04e52e82

  • SSDEEP

    1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5

Score
10/10
modiloaderpersistencetrojanupx

Malware Config

Targets

    • Target

      a53ed56299046d626f16964c38b67160_NeikiAnalytics

    • Size

      112KB

    • MD5

      a53ed56299046d626f16964c38b67160

    • SHA1

      933fa421e9ca31cd4c2a1a954921fbe887161eb2

    • SHA256

      7db74d3c79d6f8ece89fa9465393791c2f8b8f4974953373ba6733fa0ffcf8a3

    • SHA512

      f0fa707661a8d2c2101bca96af40e8a084fd99d11a66314d59c7a5edc824e491e6b404cfbc366f30eeba28159cc86342f5920707e796fe047971d54b04e52e82

    • SSDEEP

      1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5

    Score
    10/10
    modiloadertrojanupxpersistence

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks