Overview

overview

10

Static

static

1

bfa4be68ef...54.vbs

windows7-x64

10

bfa4be68ef...54.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bfa4be68ef1e15a7482b9626b86d0f8febc7447847bde94e9bd4381e50ec4f54

  • Size

    1.3MB

  • Sample

    241120-bwazdaxmat

  • MD5

    c680c1fedc4beb93fe7bd21b677a0b62

  • SHA1

    12c81e5f1b2b0fa156abd300fbb7ec244faab055

  • SHA256

    bfa4be68ef1e15a7482b9626b86d0f8febc7447847bde94e9bd4381e50ec4f54

  • SHA512

    7eecc96e5f74ab03ba2e9566a25bf75e315ab4c7d50a01ffd2b98db251740c4b60cfe46ae1033075bcfc67fd3acb5038bf21cf3b4edfc0058da47eb661dd1adf

  • SSDEEP

    24576:WsVJZ8xRjK2rYoOPFe9nuBllKzEUj4YbTyfl1rJjtpyso5AjtagDc:tUDrYo4fllKHa/Bcgg

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      bfa4be68ef1e15a7482b9626b86d0f8febc7447847bde94e9bd4381e50ec4f54

    • Size

      1.3MB

    • MD5

      c680c1fedc4beb93fe7bd21b677a0b62

    • SHA1

      12c81e5f1b2b0fa156abd300fbb7ec244faab055

    • SHA256

      bfa4be68ef1e15a7482b9626b86d0f8febc7447847bde94e9bd4381e50ec4f54

    • SHA512

      7eecc96e5f74ab03ba2e9566a25bf75e315ab4c7d50a01ffd2b98db251740c4b60cfe46ae1033075bcfc67fd3acb5038bf21cf3b4edfc0058da47eb661dd1adf

    • SSDEEP

      24576:WsVJZ8xRjK2rYoOPFe9nuBllKzEUj4YbTyfl1rJjtpyso5AjtagDc:tUDrYo4fllKHa/Bcgg

    Score
    10/10
    modiloaderdiscoverytrojanpersistence

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks