General
-
Target
108125ff659fcad54b44bc3419ed0a3a15b8df0d077c746928938a6418874372
-
Size
90KB
-
Sample
240704-xjwafatbrr
-
MD5
57b9a77105f87ad57df66bd96ee2bf2e
-
SHA1
85112fa8dff5066a4e9549c03da5906e45af008b
-
SHA256
108125ff659fcad54b44bc3419ed0a3a15b8df0d077c746928938a6418874372
-
SHA512
655a8817c09afe760c690929f63d3366a68e8548923db95b21c1e6157af633e882554cb6520bf00512a04078e568f048242098680c6eb951190e091341220700
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Behavioral task
behavioral1
Sample
108125ff659fcad54b44bc3419ed0a3a15b8df0d077c746928938a6418874372.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
108125ff659fcad54b44bc3419ed0a3a15b8df0d077c746928938a6418874372.exe
Resource
win10v2004-20240704-en
Malware Config
Targets
-
-
Target
108125ff659fcad54b44bc3419ed0a3a15b8df0d077c746928938a6418874372
-
Size
90KB
-
MD5
57b9a77105f87ad57df66bd96ee2bf2e
-
SHA1
85112fa8dff5066a4e9549c03da5906e45af008b
-
SHA256
108125ff659fcad54b44bc3419ed0a3a15b8df0d077c746928938a6418874372
-
SHA512
655a8817c09afe760c690929f63d3366a68e8548923db95b21c1e6157af633e882554cb6520bf00512a04078e568f048242098680c6eb951190e091341220700
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-