General

  • Target

    aadf1b8becca4e108e38d528310170abf516beffda48ac00e7618fb1188ac8dc

  • Size

    90KB

  • Sample

    241206-bnwwwaykcj

  • MD5

    bbe21bb6865d1121216b54da4ab730a8

  • SHA1

    0168797721c34fed3e8d5cda7b36016b9f61d36f

  • SHA256

    aadf1b8becca4e108e38d528310170abf516beffda48ac00e7618fb1188ac8dc

  • SHA512

    3c6050f83b9cf7559bc724e7dd90e4e400990a4c82b29a52984d3ea36bac10322ba75b1760d855f4718c1680a9018833daecea29b138c3d3526e7239989ab7f1

  • SSDEEP

    1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oD8:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE36

Malware Config

Targets

    • Target

      aadf1b8becca4e108e38d528310170abf516beffda48ac00e7618fb1188ac8dc

    • Size

      90KB

    • MD5

      bbe21bb6865d1121216b54da4ab730a8

    • SHA1

      0168797721c34fed3e8d5cda7b36016b9f61d36f

    • SHA256

      aadf1b8becca4e108e38d528310170abf516beffda48ac00e7618fb1188ac8dc

    • SHA512

      3c6050f83b9cf7559bc724e7dd90e4e400990a4c82b29a52984d3ea36bac10322ba75b1760d855f4718c1680a9018833daecea29b138c3d3526e7239989ab7f1

    • SSDEEP

      1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oD8:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE36

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Modiloader family

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.