General

  • Target

    2ed854f78a55a25f68bf507868a08eac5888fb5b3ad6ccef37d18df39c556c93

  • Size

    90KB

  • Sample

    240926-ypm2paycma

  • MD5

    d51fee3e1f838e08fc097d7a9190a65c

  • SHA1

    1e272cf751ad6632d8e536c59ada7eff9661b1ee

  • SHA256

    2ed854f78a55a25f68bf507868a08eac5888fb5b3ad6ccef37d18df39c556c93

  • SHA512

    48395c19edcdf69405f15b360500f9849089898eeeb416c07be6d6cb79ab4f2eff11c61a3351d898ee1127470846b732f58eb34ef3a7a078c19c6200504c3c01

  • SSDEEP

    1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y

Malware Config

Targets

    • Target

      2ed854f78a55a25f68bf507868a08eac5888fb5b3ad6ccef37d18df39c556c93

    • Size

      90KB

    • MD5

      d51fee3e1f838e08fc097d7a9190a65c

    • SHA1

      1e272cf751ad6632d8e536c59ada7eff9661b1ee

    • SHA256

      2ed854f78a55a25f68bf507868a08eac5888fb5b3ad6ccef37d18df39c556c93

    • SHA512

      48395c19edcdf69405f15b360500f9849089898eeeb416c07be6d6cb79ab4f2eff11c61a3351d898ee1127470846b732f58eb34ef3a7a078c19c6200504c3c01

    • SSDEEP

      1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.