Overview

overview

10

Static

static

3

93674e207f...b1.exe

windows7-x64

10

93674e207f...b1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    35811e8d8969bef5354c7c3e6dbefb27.bin

  • Size

    466KB

  • Sample

    241202-blqbbawrek

  • MD5

    d814415e42ff084c471b8abb6df9698e

  • SHA1

    46bed1132957d61083ce499ba3aaf29fdc74d1a4

  • SHA256

    a865791beeac90a406e11c3f79dfe163c65ebf8af22cf920d7d86c36597fef6b

  • SHA512

    ff1558973b3a57d5504d7b5b01160cc1f2415b3eb9d0bd6984cfb7c896e7e7a56ac992c73207ce81be518aab98c154dbb7d6fee1135d7809423c05c62f0728ce

  • SSDEEP

    12288:/UDDmmRt94yyZVR4rM1Cu/qLsIW/+MjsrA3a1Rz4kde7btA:/i1Rt9kZVR4rAC7S+MjsrAq1JNeFA

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      93674e207f913c1e8fa39a6e75807c6865c73feee39e38e7a9747003c8bd22b1.exe

    • Size

      1.0MB

    • MD5

      35811e8d8969bef5354c7c3e6dbefb27

    • SHA1

      e4696f8af5a54511e89b0153a443c891ffd56511

    • SHA256

      93674e207f913c1e8fa39a6e75807c6865c73feee39e38e7a9747003c8bd22b1

    • SHA512

      61d0e4be16d68775c5b73b52e976fb64d10a6a16a5ddf94312c26947268b378fd04f19242a5d9d281e4f30fcec9def9e60c15819b9428c0660ecc99c067910f0

    • SSDEEP

      12288:uYpg9YBvkXS4+lSFSZtY09Rzviu3E3Xxb5upgNcyAq9cfeWybiZFIO37Lftiid:TCYkXV+ldZtDRDiuqx1SeWybiZFIOn

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks