Overview

overview

10

Static

static

3

OikControl...4).exe

windows7-x64

10

OikControl...4).exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OikControl_v2_3(2024_07_04).exe

  • Size

    15.7MB

  • Sample

    240711-kz1hwasaje

  • MD5

    e064ed0457703f0ed520e2c6e6d46686

  • SHA1

    16255a5c23610e885d284bb092daebec3a76106e

  • SHA256

    21b41e8e72d7ec2f178910fc4fd93dd33bd582106987d1b05887e944918d2f51

  • SHA512

    60c93b86bb7f69b7bed481793bd25fee05d29b3331a8090ef01ab9aa2051ea25d0e1e19e67f9201d3642bbc588fac66e58a56305e21c9bfe4d5ff36bdd30e686

  • SSDEEP

    393216:9OmViyUUp2l5rYjbrKd6qsN7YlRwJfSBFfa:9BiyUFLEECSDfa

Score
10/10
modiloadercryptoneevasionpackertrojan

Malware Config

Targets

    • Target

      OikControl_v2_3(2024_07_04).exe

    • Size

      15.7MB

    • MD5

      e064ed0457703f0ed520e2c6e6d46686

    • SHA1

      16255a5c23610e885d284bb092daebec3a76106e

    • SHA256

      21b41e8e72d7ec2f178910fc4fd93dd33bd582106987d1b05887e944918d2f51

    • SHA512

      60c93b86bb7f69b7bed481793bd25fee05d29b3331a8090ef01ab9aa2051ea25d0e1e19e67f9201d3642bbc588fac66e58a56305e21c9bfe4d5ff36bdd30e686

    • SSDEEP

      393216:9OmViyUUp2l5rYjbrKd6qsN7YlRwJfSBFfa:9BiyUFLEECSDfa

    Score
    10/10
    modiloadercryptoneevasionpackertrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • CryptOne packer

      Detects CryptOne packer defined in NCC blogpost.

      cryptonepacker

    • ModiLoader First Stage

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

1
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks