General
-
Target
57c6b0ef0c613e7b89e75ba925cebe80N.exe
-
Size
116KB
-
Sample
240726-z7wbfsvhpj
-
MD5
57c6b0ef0c613e7b89e75ba925cebe80
-
SHA1
2cc1808526af22ac1dd8a885735ad8a5e233d5c5
-
SHA256
fe74b4fc0b1b74f9b4659ac28f601990ee4b1e6b6e6cbb52e03e9300c1571ad8
-
SHA512
b4475ff5f368a83c591963f009164c81959acccfca82f9eefd6a8ae2eac47bfd8ca690b374fb63bdd7459c297cab1bafe902ef1b303e358bad4930bb63e0526e
-
SSDEEP
1536:JOH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5PxV1:JCKQJcinxphkG5Q6GdpIOkJHhKRf1
Static task
static1
Behavioral task
behavioral1
Sample
57c6b0ef0c613e7b89e75ba925cebe80N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
57c6b0ef0c613e7b89e75ba925cebe80N.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
57c6b0ef0c613e7b89e75ba925cebe80N.exe
-
Size
116KB
-
MD5
57c6b0ef0c613e7b89e75ba925cebe80
-
SHA1
2cc1808526af22ac1dd8a885735ad8a5e233d5c5
-
SHA256
fe74b4fc0b1b74f9b4659ac28f601990ee4b1e6b6e6cbb52e03e9300c1571ad8
-
SHA512
b4475ff5f368a83c591963f009164c81959acccfca82f9eefd6a8ae2eac47bfd8ca690b374fb63bdd7459c297cab1bafe902ef1b303e358bad4930bb63e0526e
-
SSDEEP
1536:JOH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5PxV1:JCKQJcinxphkG5Q6GdpIOkJHhKRf1
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-