Overview

overview

10

Static

static

3

Crypter.exe

windows7-x64

10

Crypter.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d7e41dba49cbc1c7794f7ec8700353101fe22409bb17a74911d64aac3a5657ce

  • Size

    1.0MB

  • Sample

    240917-wzrfraxepp

  • MD5

    e76cbe86751183e779e0d1fc83178a1e

  • SHA1

    d20dcdd3c172efefdafc6dc115de713a82b87156

  • SHA256

    d7e41dba49cbc1c7794f7ec8700353101fe22409bb17a74911d64aac3a5657ce

  • SHA512

    80080aaa828e632c4916600e72913de312fd465006dc74e7235396bb8498d9d5622f9d27af5bb118e2803252283db5c1fbf6eaa2bd15207024ae0262b2ca774e

  • SSDEEP

    24576:k0pMiBKtR9jmZLHUbCqjjUfxhzoHRiQAghGHWy:FS4O0LHUOAj+xh2U8ly

Score
10/10
modiloaderbootkitdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      Crypter.exe

    • Size

      1.0MB

    • MD5

      457ab4a671a1edc31a9b5fcc7a1fea20

    • SHA1

      30940b379a3df1db36531daf1e4ea0c1c7c61057

    • SHA256

      8f84b4b3c250352411c417072251fa34b3dbc2b8ba676638e92c35717b3835a1

    • SHA512

      4aa5b80371b33fd4645def0076a09a913ee05193a93352f79c036fb882e3dd04dd2667e23c1a98edeebd25fe41d4077fcd945136ba2247423a6d3729c56b47fe

    • SSDEEP

      24576:98Q2YflOswOoxXoKZVbB9uCMoilWWMps1eXso/72f2m:9n20lObBxtZNKvMps1uT2f2m

    Score
    10/10
    modiloaderbootkitdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks