modiloader | 1810fc024d4da8c805bdf76c8152ec68615c33676c4bee025d889de89af3724f

General

Target

MLClauncher.exe
Size

66KB
Sample

240529-v2kwbaca5y
MD5

23e7e5af720dfc90b86294a8a7800c76
SHA1

e674bd73e3c9a496c9b5422f43874fcfc9f5510c
SHA256

1810fc024d4da8c805bdf76c8152ec68615c33676c4bee025d889de89af3724f
SHA512

0bb3731bfd6601b9b903ce93aa3fc493d063d5ddb20b7e2277808205bcde96f5cc7dafc94caf59ec5e7d0b8a44aa6b739cc6f326d29aaa03c3b85c090cab3681
SSDEEP

1536:rttwy1I4PKiFM8tBb1L1JmX2npd6KnXOUVBCIu9BE:BBRPXb1L22pDXOUPCpBE

Score

10^/10

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:2832

20.ip.gl.ply.gg:2832

financial-merchandise.gl.at.ply.gg:64299

<Xwormmm>:1

Attributes

Install_directory
%Temp%
install_file
svhost.exe

Targets

- Target
  
  MLClauncher.exe
- Size
  
  66KB
- MD5
  
  23e7e5af720dfc90b86294a8a7800c76
- SHA1
  
  e674bd73e3c9a496c9b5422f43874fcfc9f5510c
- SHA256
  
  1810fc024d4da8c805bdf76c8152ec68615c33676c4bee025d889de89af3724f
- SHA512
  
  0bb3731bfd6601b9b903ce93aa3fc493d063d5ddb20b7e2277808205bcde96f5cc7dafc94caf59ec5e7d0b8a44aa6b739cc6f326d29aaa03c3b85c090cab3681
- SSDEEP
  
  1536:rttwy1I4PKiFM8tBb1L1JmX2npd6KnXOUVBCIu9BE:BBRPXb1L22pDXOUPCpBE
Score

10^/10

xworm execution persistence rat trojan modiloader stormkitty aspackv2 bootkit evasion spyware stealer upx
- Detect Xworm Payload
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- UAC bypass
  evasion trojan
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- ModiLoader Second Stage
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2