Overview

overview

10

Static

static

3

f711703c8b...54.exe

windows7-x64

10

f711703c8b...54.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f711703c8ba66dcedb8e4b83f21a0425c528e278242c852fd5cf54bb43e30454

  • Size

    1.0MB

  • Sample

    241113-jqdgba1lep

  • MD5

    31bc6907d6097a76bb1dd891cfc09b7a

  • SHA1

    97340ca203a1207e492135d580c6860a724a227f

  • SHA256

    f711703c8ba66dcedb8e4b83f21a0425c528e278242c852fd5cf54bb43e30454

  • SHA512

    6c217fa37cc4c655cda0a2a491e49ac736e4940027178b3c7d6488d296923d40cc26a4d0142052b94b58491fa90f17ab3f4115cb0c75efe09175e732d62dbbf5

  • SSDEEP

    24576:BJSK4Kavab3wMeAOr6ZFlR+gKT44VoIOL7zk:7K1WYL6L

Score
10/10
modiloaderdiscoverypersistencespywarestealertrojan

Malware Config

Targets

    • Target

      f711703c8ba66dcedb8e4b83f21a0425c528e278242c852fd5cf54bb43e30454

    • Size

      1.0MB

    • MD5

      31bc6907d6097a76bb1dd891cfc09b7a

    • SHA1

      97340ca203a1207e492135d580c6860a724a227f

    • SHA256

      f711703c8ba66dcedb8e4b83f21a0425c528e278242c852fd5cf54bb43e30454

    • SHA512

      6c217fa37cc4c655cda0a2a491e49ac736e4940027178b3c7d6488d296923d40cc26a4d0142052b94b58491fa90f17ab3f4115cb0c75efe09175e732d62dbbf5

    • SSDEEP

      24576:BJSK4Kavab3wMeAOr6ZFlR+gKT44VoIOL7zk:7K1WYL6L

    Score
    10/10
    modiloaderdiscoverytrojanpersistencespywarestealer

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks