Overview

overview

10

Static

static

1

saw.bat

windows7-x64

7

saw.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    saw.bat

  • Size

    3.1MB

  • Sample

    241129-h52a9asnez

  • MD5

    1bfba49c6fe199c29d2157f1c80fa1e3

  • SHA1

    10e2e65847e30bc33009ae0469888d331e5aa7fe

  • SHA256

    a691aa20791fe3b50c0b797b8a2939e505f8e92fef2661738359df582b4ddbc0

  • SHA512

    dc10f9a61ef08fe9e395037be5c5d9d9dcb6f6360f75afa2a2f70db412230d9d4fe9a2c1065e270d326663944a6fb81547a44dec1d17655637e1547be9cf6eee

  • SSDEEP

    24576:xxwRiELFSEl5Qv6iP6Vcy5z/K3EzuwTZ9b8063u9CqNaTBAOI3c8zhq4zoc8hnKP:xGR5SEfQZ695bJZfNMADq48c8hn94Z

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      saw.bat

    • Size

      3.1MB

    • MD5

      1bfba49c6fe199c29d2157f1c80fa1e3

    • SHA1

      10e2e65847e30bc33009ae0469888d331e5aa7fe

    • SHA256

      a691aa20791fe3b50c0b797b8a2939e505f8e92fef2661738359df582b4ddbc0

    • SHA512

      dc10f9a61ef08fe9e395037be5c5d9d9dcb6f6360f75afa2a2f70db412230d9d4fe9a2c1065e270d326663944a6fb81547a44dec1d17655637e1547be9cf6eee

    • SSDEEP

      24576:xxwRiELFSEl5Qv6iP6Vcy5z/K3EzuwTZ9b8063u9CqNaTBAOI3c8zhq4zoc8hnKP:xGR5SEfQZ695bJZfNMADq48c8hn94Z

    Score
    10/10
    discoverymodiloaderpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks