modiloader | 2024-11-03_84fabef18682779f05856d9dd96e4b7d_kovter | Triage

Sharing

General

Target

2024-11-03_84fabef18682779f05856d9dd96e4b7d_kovter
Size

1.3MB
MD5

84fabef18682779f05856d9dd96e4b7d
SHA1

691b6ee3c2502a2ec1b202d1f3e5ee38be531453
SHA256

c30691de8d45358bc37f2cc72f89e053f77568b15ff4e4123dd13577e7951f89
SHA512

3dd0ebf918e3b7c8be1e7861309643553c0c252c102f16438f9f81afa8b112213948423d057af72f636c6bcb96da457588b8c4661765d7bb2a5412bdd9a715ce
SSDEEP

24576:8E9ZooL/6M1v2EX1IWEDJ5oUbuM1PWkXzxM:f9SU6MAEFI1dyUbuMAkjxM

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2024-11-03_84fabef18682779f05856d9dd96e4b7d_kovter

Files

2024-11-03_84fabef18682779f05856d9dd96e4b7d_kovter
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 327KB - Virtual size: 327KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 18KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ