General
-
Target
17062024_1632_lNV-2024-3626276279.Tar
-
Size
1.1MB
-
Sample
240617-t111gawbpa
-
MD5
a3dc9856bc6a39e3c0159b1f2a2d2510
-
SHA1
5e3794ff7876d85f6b4da40c978ac0bfffc6f0d2
-
SHA256
2a852296a5a9851655ab8b12ebbc8c2a265823a56fa6fc67d64eb865b06289ef
-
SHA512
b2f090730872dad62e132d215a898eccebf235021cbaf15aa227790f3bdca25490573649eaa1f875dd549346acaae8e3f6073fcfc9f235b455c1a1f01a5e9dac
-
SSDEEP
24576:1TE5nA+KciVqYtJa4UrMIV669HpTf6JU2+HuaQ392Dn75ASIeHdmvALKvajpkKPs:1QnA9z5tJa4U759HpL6JJ/sb750kdmlb
Static task
static1
Behavioral task
behavioral1
Sample
lNV-2024-3626276279.cmd
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
lNV-2024-3626276279.cmd
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
lNV-2024-3626276279.cmd
-
Size
4.2MB
-
MD5
55517abac6d9789ddcde10ce5ba82872
-
SHA1
dba9aeaf67ee05ca8a38ba5ffdb75607b8a2288d
-
SHA256
ecb54d88590475659fa26d0e65d0743d19e42441fe6311e38dec28026fc95945
-
SHA512
b951dd6e870d77250af92f4f8920f57622fbd2e58c555abeb704993d51cd0b052cc7b2ec5f98c4d91011f76117bab6717aa25fa775adf899c32d2c5d26453207
-
SSDEEP
49152:H0HI7tGDjsb7rA3kn2IU9svyG1qrN3Gbiu8HHKMi4F2652/0cN6g/BdKgJ:5
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-