Overview

overview

10

Static

static

3

23b47a0506...c9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20058219412.zip

  • Size

    482KB

  • Sample

    241122-p17e2a1kcs

  • MD5

    8e1c756ed7297711121306d87b209c13

  • SHA1

    4d9c616653b485ad13d007505db9bb289d87e0f5

  • SHA256

    a0a2474232a053376a3d7c7074a1b05fd2d01a680dc0179e4414a7bbbfcc3569

  • SHA512

    809e533e4688de648037d777a9e7888d13950d382f537efc6369d40573af1c078b065630863c08f823d3faa11983ecc1d1719eeb276daa80406b6950c82ab7fc

  • SSDEEP

    12288:Gb3dcRLLLBAONbFds7No4qcyyuHCHrh0o:GbGLVAO5ns7NUcXKCHd0o

Score
10/10
modiloaderdiscoverypersistencespywarestealertrojan

Malware Config

Targets

    • Target

      23b47a050614d71d7081f8e0313c972e9e6b1df6c9eec10f59b6ee06d0506ec9

    • Size

      1.0MB

    • MD5

      bdc3b662d1136f20f51f55a0f6a2fb9d

    • SHA1

      ef8baad4f0f3f96e2d04f3c6cea1471bcd651008

    • SHA256

      23b47a050614d71d7081f8e0313c972e9e6b1df6c9eec10f59b6ee06d0506ec9

    • SHA512

      29036ced934c7668b072c811285761a2b4cdd562b2d269e50be767e8be27589117e84bf0f34b0323912a3dea4545dab9b9e5a6046c8beb36d15ef65056a88ad8

    • SSDEEP

      24576:/GBqWzMJ3rInJFhR1T6a3R6ZFlR+gKT44VoIOL7zk:/CHnca8YL6L

    Score
    10/10
    modiloaderdiscoverypersistencespywarestealertrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks