modiloader | e2c30d56ebe22a63da76a6e1e7a536322fd67ec30baf8ed1060042531c88ca4a

Sharing

Copy URL Twitter E-mail

General

Target
e2c30d56ebe22a63da76a6e1e7a536322fd67ec30baf8ed1060042531c88ca4a
Size 46KB
Sample241208-ejblxs1pgt
SHA256 e2c30d56ebe22a63da76a6e1e7a536322fd67ec30baf8ed1060042531c88ca4a
MD5 cb2832d46b0a24da44fd6ff09a7ef0da
SHA1 3ac43db7bbc4f265e864d41798cd96009cde311d
SHA512 b87e4cb3ef355c2148749c6118454b2ebb73e13ff92040507863c23d85da7ad1c17e61e5e7e6c1a80492a2dcd4d433cd704c9171bc236769f7972674e203dd48
SSDEEP 768:ERVNq/9pkEAj2KMWj6kOzeQ5wdSqkLS/Kk6zfwc2feWr/5S3gTXLtI:ELNq/8ECJj6kZSAHcL3KXRI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e2c30d56ebe22a63da76a6e1e7a536322fd67ec30baf8ed1060042531c88ca4a

File Explorer

e2c30d56ebe22a63da76a6e1e7a536322fd67ec30baf8ed1060042531c88ca4a

.exe 46KB

e2c30d56ebe22a63da76a6e1e7a536322fd67ec30baf8ed1060042531c88ca4a

SHA256 e2c30d56ebe22a63da76a6e1e7a536322fd67ec30baf8ed1060042531c88ca4a
MD5 cb2832d46b0a24da44fd6ff09a7ef0da
SHA1 3ac43db7bbc4f265e864d41798cd96009cde311d
SHA512 b87e4cb3ef355c2148749c6118454b2ebb73e13ff92040507863c23d85da7ad1c17e61e5e7e6c1a80492a2dcd4d433cd704c9171bc236769f7972674e203dd48
SSDEEP 768:ERVNq/9pkEAj2KMWj6kOzeQ5wdSqkLS/Kk6zfwc2feWr/5S3gTXLtI:ELNq/8ECJj6kZSAHcL3KXRI
MD5 SHA1 SHA512 SSDEEP

windows:1 windows x86 arch:x86

ModiLoader Second Stage
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37200

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1024B

Virtual Size

996B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.nkh

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

e2c30d56ebe22a63da76a6e1e7a536322fd67ec30baf8ed1060042531c88ca4a

generic