Overview

overview

10

Static

static

5

c9b8f16215...2d.exe

windows7-x64

10

c9b8f16215...2d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c9b8f16215081e71f3cc23d6c102d8a3deaee3ee754d9f268ca21471fe26552d.exe

  • Size

    90KB

  • Sample

    241201-v9aqbaxlet

  • MD5

    eaf3cc8bc81f2a324937a23f5c25a7eb

  • SHA1

    ac314a515263722a9f923817892b67543e4e43c0

  • SHA256

    c9b8f16215081e71f3cc23d6c102d8a3deaee3ee754d9f268ca21471fe26552d

  • SHA512

    f4afa5a3ceb1f0b1373d21250cfb85c732a68050aeb7bc833e90f708e34c2ad090c45bc39b166fc4aa08d25e293fc0a987cb2f687f6874f94b1ca9a57cc098dd

  • SSDEEP

    1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDd:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3X

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      c9b8f16215081e71f3cc23d6c102d8a3deaee3ee754d9f268ca21471fe26552d.exe

    • Size

      90KB

    • MD5

      eaf3cc8bc81f2a324937a23f5c25a7eb

    • SHA1

      ac314a515263722a9f923817892b67543e4e43c0

    • SHA256

      c9b8f16215081e71f3cc23d6c102d8a3deaee3ee754d9f268ca21471fe26552d

    • SHA512

      f4afa5a3ceb1f0b1373d21250cfb85c732a68050aeb7bc833e90f708e34c2ad090c45bc39b166fc4aa08d25e293fc0a987cb2f687f6874f94b1ca9a57cc098dd

    • SSDEEP

      1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDd:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3X

    Score
    10/10
    modiloaderdiscoverypersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks