Extracted

• • Target

    11092024_1553_x.exe

  • Size

    1.4MB

  • MD5

    8872ae05051a2b0a1bd5e3fa1e8b7026

  • SHA1

    a6e5a34b728053cec654fb7b023a1eab995abaf3

  • SHA256

    3160d9c11f6f43c507b9bebad9ddfa924f10af71394d3179988a16463170f61c

  • SHA512

    413e2c400c6d2723d187ac6e26b5637c62826a37ab7a77acf0278ccba4fd12f55d224a0a3afa3fde93bca87b909f7edc54aea25475fec0055d887499e377343f

  • SSDEEP

    24576:Gj2o2Y8F82BK8Uk1zVvS+8OioUMxW24Q7Q9Z:2pihG+8OiSWaOZ

  Score

  10^/10

  modiloaderdiscoverypersistencetrojancredential_accessspywarestealer

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • ModiLoader Second Stage

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2