General

  • Target

    a9ab6ae9fb0198840b9309d04dfeff8cdacd81a4edcc6bc7c32879608ae765b3

  • Size

    1.5MB

  • Sample

    240621-bjp8jaycnq

  • MD5

    026413bbfef5671928ad071ec2abb31a

  • SHA1

    65d9c92d986961ea05431a937f75a193a09de3b0

  • SHA256

    a9ab6ae9fb0198840b9309d04dfeff8cdacd81a4edcc6bc7c32879608ae765b3

  • SHA512

    d93cf780d1ad11519e21293254f779fc9fbc14f8fbdd4a86854ed00ce8d39c3bf4c08e7a1da887aeae350c5d3c0a02b9b4e39efd34dbf962ea2d61e3871107c3

  • SSDEEP

    24576:Gb8mxc3aLtwdDxaSQnr9yceV8FCsKbX3bEyh5lMV/M6x:GRdiRgyrlMV/M6

Malware Config

Targets

    • Target

      a9ab6ae9fb0198840b9309d04dfeff8cdacd81a4edcc6bc7c32879608ae765b3

    • Size

      1.5MB

    • MD5

      026413bbfef5671928ad071ec2abb31a

    • SHA1

      65d9c92d986961ea05431a937f75a193a09de3b0

    • SHA256

      a9ab6ae9fb0198840b9309d04dfeff8cdacd81a4edcc6bc7c32879608ae765b3

    • SHA512

      d93cf780d1ad11519e21293254f779fc9fbc14f8fbdd4a86854ed00ce8d39c3bf4c08e7a1da887aeae350c5d3c0a02b9b4e39efd34dbf962ea2d61e3871107c3

    • SSDEEP

      24576:Gb8mxc3aLtwdDxaSQnr9yceV8FCsKbX3bEyh5lMV/M6x:GRdiRgyrlMV/M6

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks