Overview

overview

10

Static

static

5

MAP=PWN Co....2.exe

windows10-1703-x64

10

MAP=PWN Co....2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MAP=PWN Convert 0.3.2.exe

  • Size

    1.9MB

  • Sample

    240926-nv62msycqa

  • MD5

    ab007bde894908c5a82c6480165a3922

  • SHA1

    df7167709c9f3f364869cb09b8236820a0fdb2df

  • SHA256

    64b1998f76651ad1f8a96b2695317b0c4fde805393544398f21ed52240a989bf

  • SHA512

    e4836c8dc3cbae8280d2469a5b8e3d2d32559a7de84b5c36eb346b87c8fcbb181a0e1d58123b893bb45d97156f6b7f8c661563d526534bdd0caa6bfcad1a6eb3

  • SSDEEP

    49152:pghXolANVdolATEDwmCQqnvObbxdpq5z9Tnh:pgilAN7MyhLrnvy7yZTh

Score
10/10
modiloaderdiscoverytrojanupx

Malware Config

Targets

    • Target

      MAP=PWN Convert 0.3.2.exe

    • Size

      1.9MB

    • MD5

      ab007bde894908c5a82c6480165a3922

    • SHA1

      df7167709c9f3f364869cb09b8236820a0fdb2df

    • SHA256

      64b1998f76651ad1f8a96b2695317b0c4fde805393544398f21ed52240a989bf

    • SHA512

      e4836c8dc3cbae8280d2469a5b8e3d2d32559a7de84b5c36eb346b87c8fcbb181a0e1d58123b893bb45d97156f6b7f8c661563d526534bdd0caa6bfcad1a6eb3

    • SSDEEP

      49152:pghXolANVdolATEDwmCQqnvObbxdpq5z9Tnh:pgilAN7MyhLrnvy7yZTh

    Score
    10/10
    modiloaderdiscoverytrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader First Stage

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks