Overview

overview

10

Static

static

3

1907902a5b...47.exe

windows7-x64

10

1907902a5b...47.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647

  • Size

    112KB

  • Sample

    240925-xreyesvglf

  • MD5

    3555e501530260e4d1c0435b486dc374

  • SHA1

    e92110342c9042e18296c6e29bcd99c8be8dcdfd

  • SHA256

    1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647

  • SHA512

    c2855d711959da2cea292566cad4e6a642150f193d684f9eb86b35b7a9d30806ee1aa1c4f87ea2346068ba130bebf5c620a5f8b33d5b9ef356c37f6b8c98e9a6

  • SSDEEP

    1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647

    • Size

      112KB

    • MD5

      3555e501530260e4d1c0435b486dc374

    • SHA1

      e92110342c9042e18296c6e29bcd99c8be8dcdfd

    • SHA256

      1907902a5b8b7e49e4119df57243964b93c1636a9fe5fbf7939bd468c6573647

    • SHA512

      c2855d711959da2cea292566cad4e6a642150f193d684f9eb86b35b7a9d30806ee1aa1c4f87ea2346068ba130bebf5c620a5f8b33d5b9ef356c37f6b8c98e9a6

    • SSDEEP

      1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5

    Score
    10/10
    modiloaderdiscoverytrojanupxpersistence

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks