General
-
Target
693c54d22b1c20ff6b5aeeef31680c6e6ca0d240d360741fb0a29c5f832b6de9
-
Size
90KB
-
Sample
241102-mys4hsvmdm
-
MD5
b578ff96ad82d798a420fe93237fd057
-
SHA1
10e9f9d3830a64eea020a7fc69e216321d286ae7
-
SHA256
693c54d22b1c20ff6b5aeeef31680c6e6ca0d240d360741fb0a29c5f832b6de9
-
SHA512
98e579da2276bce605dca2de2e5199cada518fd4d865440824805a28a2f1f63cb888cac6a4441bf47543f0254cb3fa62906a79281aa86d9697592e448b65acba
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Behavioral task
behavioral1
Sample
693c54d22b1c20ff6b5aeeef31680c6e6ca0d240d360741fb0a29c5f832b6de9.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
693c54d22b1c20ff6b5aeeef31680c6e6ca0d240d360741fb0a29c5f832b6de9.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
693c54d22b1c20ff6b5aeeef31680c6e6ca0d240d360741fb0a29c5f832b6de9
-
Size
90KB
-
MD5
b578ff96ad82d798a420fe93237fd057
-
SHA1
10e9f9d3830a64eea020a7fc69e216321d286ae7
-
SHA256
693c54d22b1c20ff6b5aeeef31680c6e6ca0d240d360741fb0a29c5f832b6de9
-
SHA512
98e579da2276bce605dca2de2e5199cada518fd4d865440824805a28a2f1f63cb888cac6a4441bf47543f0254cb3fa62906a79281aa86d9697592e448b65acba
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-