Overview

overview

10

Static

static

3

b8ce7b8f60...JC.exe

windows7-x64

10

b8ce7b8f60...JC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b8ce7b8f60bb42477ea6bba32_JC.xz

  • Size

    1.1MB

  • Sample

    241203-ldyb3avkgk

  • MD5

    7e3bac2b62f1cbe305e1ac8281969125

  • SHA1

    7185b30bb42a7907c30a93dd345646ed8f694fd2

  • SHA256

    b8ce7b8f60bb42477ea6bba328bfd310cfec0c1ebbc1f60ce4b2571e240d9d57

  • SHA512

    96de9b9a34f1f2769508940dae3923e551e274f79d626970fc2c20d96d63246e0aee7ac1599cbd1225eb904b421b7c7e1c2ffa33e9f9cbe5f5e2b2d7cfc78924

  • SSDEEP

    24576:/KeEuyabQw5jTlkclAu8MbYalgYOCcvBVtOJA51wPKLRuxAyH2k2GlOPdWs4bJ:hEkN5fMFmXWYlcvBVt2FyLRuxXWGlOla

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      b8ce7b8f60bb42477ea6bba32_JC

    • Size

      1.5MB

    • MD5

      0d4b25a33c69e4443f28a43ae3b015c9

    • SHA1

      92267c25dc62805bdfff9497174bf91feec90f2c

    • SHA256

      869eb1b44b9d5e0ee5b99b1189edd21d706c58094387ba32ebf2aa45703a9c9b

    • SHA512

      f628aaa5e739534b6e7833f44ca96e3a83dc83aac026b0f75c3919e937ed468d18764f1b2347995822e98d3eb6c6797524c0c28d4c6371f3a9c57dab0eac9e1f

    • SSDEEP

      24576:rbGHGrOrQ9gnMC6LO3cQoikKgti8PM2MCUrTDLwVIf2IOXkDtZ3NptsNbJZ:rbGWAJeDingti8P+TwSNO0n9vwbJZ

    Score
    10/10
    modiloaderdiscoverytrojanpersistence

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • Suspicious use of NtCreateProcessOtherParentProcess

    • ModiLoader Second Stage

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks