modiloader | 338c220997baa0485c25470cde2f7c2d4ef75160eb873192a5365a2e0e8f715c

General

Target

XClient.exe
Size

102KB
Sample

240518-ykdbpace2s
MD5

5e24357f522943541ff27ef9b9bb562a
SHA1

61866fdd5e79a11c867b47d76c15db24e785ecd2
SHA256

338c220997baa0485c25470cde2f7c2d4ef75160eb873192a5365a2e0e8f715c
SHA512

658d3d5951a239ecd409a567d59b59db009ac4c86dc2a1b92eaab32ae568410c8262901b1acfc4eae486f39adb0d374a533f227649fccc94193a6b849929df59
SSDEEP

1536:eqyNVGF7YnjFF8pNhgUGSL1bWZR9/CJbZT6YdaOpYYVfccAvizZuvdigE:SV/njFF8r5fbWZR+54OpYJ1quvdiv

Score

10^/10

Malware Config

Extracted

Family

xworm

C2

subjects-handbook.gl.at.ply.gg:56071

Attributes

Install_directory
%AppData%
install_file
svchost.exe

Targets

- Target
  
  XClient.exe
- Size
  
  102KB
- MD5
  
  5e24357f522943541ff27ef9b9bb562a
- SHA1
  
  61866fdd5e79a11c867b47d76c15db24e785ecd2
- SHA256
  
  338c220997baa0485c25470cde2f7c2d4ef75160eb873192a5365a2e0e8f715c
- SHA512
  
  658d3d5951a239ecd409a567d59b59db009ac4c86dc2a1b92eaab32ae568410c8262901b1acfc4eae486f39adb0d374a533f227649fccc94193a6b849929df59
- SSDEEP
  
  1536:eqyNVGF7YnjFF8pNhgUGSL1bWZR9/CJbZT6YdaOpYYVfccAvizZuvdigE:SV/njFF8r5fbWZR+54OpYJ1quvdiv
Score

10^/10

modiloader xworm aspackv2 execution persistence rat trojan umbral spyware stealer
- Detect Umbral payload
- Detect Xworm Payload
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Umbral
  Umbral stealer is an opensource moduler stealer written in C#.
  stealer umbral
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- ModiLoader Second Stage
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2