modiloader | eade1332ee8d089e13ff751acecf54b559beadff7e2b23f719eee21ba2d3df10

Resubmissions

12/12/2024, 01:56

241212-cc56vawncv10

18/11/2024, 13:48

15/11/2024, 01:42

15/11/2024, 01:41

09/11/2024, 01:42

Sharing

Copy URL Twitter E-mail

General

Target
eade1332ee8d089e13ff751acecf54b559beadff7e2b23f719eee21ba2d3df10
Size 18.5MB
Sample241109-b4st6avbme
SHA256 eade1332ee8d089e13ff751acecf54b559beadff7e2b23f719eee21ba2d3df10
MD5 bd4dfea472d4fa0e9550f739bd8d04d3
SHA1 c462a46f0ab1243ae616ccb03839e7f90b993315
SHA512 940cd64aaf9c476fed8d2031db2edc8f626be244ab4f78f392d0e608f93796fdc2d87b0ddd20ec2db0ec29c008f536192da65d2bb31442f34c73142fc3b26e20
SSDEEP 196608:6dZItlOME4gqh+r4R6N8Gb0VKgt0JjLIP6BxP6LOfXAkZ:IJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat miner modiloader netfilter netwire snakekeylogger zeppelin cobaltstrike hellokitty masslogger merlin mountlocker xmrig gcleaner remcos

Malware Config

Signatures

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
sample	cobalt_reflective_dll

Cobaltstrike family
cobaltstrike

Detected Mount Locker ransomware 1 IoCs

resource	yara_rule
sample	RANSOM_mountlocker

Detects Zeppelin payload 1 IoCs

resource	yara_rule
sample	family_zeppelin

Gcleaner family
gcleaner

HelloKitty ELF 1 IoCs

resource	yara_rule
sample	family_hellokitty_elf

Hellokitty family
hellokitty

MassLogger log file 1 IoCs

Detects a log file produced by MassLogger.

resource	yara_rule
sample	masslogger_log_file

Masslogger family
masslogger
Merlin family
merlin

Merlin payload 1 IoCs

resource	yara_rule
sample	family_merlin

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader
Mountlocker family
mountlocker

NetFilter payload 1 IoCs

resource	yara_rule
sample	netfilter_payload

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
sample	netwire

Netfilter family
netfilter
Netwire family
netwire
Remcos family
remcos

Snake Keylogger payload 1 IoCs

resource	yara_rule
sample	family_snakekeylogger

Snakekeylogger family
snakekeylogger

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
sample	family_xmrig

Xmrig family
xmrig
Zeppelin family
zeppelin

File Explorer

eade1332ee8d089e13ff751acecf54b559beadff7e2b23f719eee21ba2d3df10

18.5MB

eade1332ee8d089e13ff751acecf54b559beadff7e2b23f719eee21ba2d3df10

SHA256 eade1332ee8d089e13ff751acecf54b559beadff7e2b23f719eee21ba2d3df10
MD5 bd4dfea472d4fa0e9550f739bd8d04d3
SHA1 c462a46f0ab1243ae616ccb03839e7f90b993315
SHA512 940cd64aaf9c476fed8d2031db2edc8f626be244ab4f78f392d0e608f93796fdc2d87b0ddd20ec2db0ec29c008f536192da65d2bb31442f34c73142fc3b26e20
SSDEEP 196608:6dZItlOME4gqh+r4R6N8Gb0VKgt0JjLIP6BxP6LOfXAkZ:IJ
MD5 SHA1 SHA512 SSDEEP

Cobalt Strike reflective loader

Detects the reflective loader used by Cobalt Strike.
Detected Mount Locker ransomware
Detects Zeppelin payload
HelloKitty ELF
MassLogger log file

Detects a log file produced by MassLogger.
Merlin payload
ModiLoader Second Stage
NetFilter payload
NetWire RAT payload

rat
Snake Keylogger payload
XMRig Miner payload

miner