modiloader | d5f2aa6bebea75c9296ffade9dcf4082ba9c1dfdbba9d9f6a03f7496505192afN[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

d5f2aa6bebea75c9296ffade9dcf4082ba9c1dfdbba9d9f6a03f7496505192afN.exe
Size

2.9MB
MD5

cd6e0fff87f14397c524d9c176788040
SHA1

9fbc4e51a66cfc5b8fc6c1e6cf82612972b386b6
SHA256

d5f2aa6bebea75c9296ffade9dcf4082ba9c1dfdbba9d9f6a03f7496505192af
SHA512

7ab113576cc0f9c1dbc843ce8250f36cdf14005e26e3825ccf78f135b0626809cdb235b5976f183a1c99bfeec7b654ea322b94a3ed97b79becefb48a4d5169f0
SSDEEP

49152:Lx2OSXsTfVNX18qXTbTXedNlyU6IaKRlJAoyGV8INHUNhspo:LcOYoff18ryU6ClJAoyU8sOd

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader First Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage1

Modiloader family
modiloader

Files

d5f2aa6bebea75c9296ffade9dcf4082ba9c1dfdbba9d9f6a03f7496505192afN.exe
.exe windows:4 windows x86 arch:x86

Code Sign

04:00:00:00:00:01:15:4b:5a:c3:94
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

01-09-1998 12:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:23:9e:0f:ac:b3
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

28-01-1999 13:00

Not After

27-01-2017 12:00

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:00:00:00:00:01:30:32:33:50:83
Certificate

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Not Before

27-05-2011 15:53

Not After

27-05-2012 15:53

Subject

CN=NETRETINA SL,O=NETRETINA SL,L=Esparreguera,ST=Barcelona,C=ES

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:23:9e:0f:af:24
Certificate

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Not Before

22-01-2004 10:00

Not After

27-01-2017 10:00

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f1:de:c8:a5:e6:e5:15:31:af:ee:63:bd:3e:73:57:a7:65:d0:63:df
Signer

Actual PE Digest

f1:de:c8:a5:e6:e5:15:31:af:ee:63:bd:3e:73:57:a7:65:d0:63:df

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

EurekaLog_AttachedFilesRequestEvent
EurekaLog_CallCreateThread
EurekaLog_CallExceptObject
EurekaLog_CallExitThread
EurekaLog_CallGeneralRaise
EurekaLog_CallResumeThread
EurekaLog_CustomDataRequestEvent
EurekaLog_CustomFieldsRequestEvent
EurekaLog_ExceptionActionNotifyEvent
EurekaLog_ExceptionErrorNotifyEvent
EurekaLog_ExceptionNotifyEvent
EurekaLog_PasswordRequestEvent
EurekaLog_PasswordRequestEventEx
ExceptionManager

Sections

CODE
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 28KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 615B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 235B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

04:00:00:00:00:01:15:4b:5a:c3:94Certificate

Key Usages

04:00:00:00:00:01:23:9e:0f:ac:b3Certificate

Extended Key Usages

Key Usages

01:00:00:00:00:01:30:32:33:50:83Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:23:9e:0f:af:24Certificate

Extended Key Usages

Key Usages

f1:de:c8:a5:e6:e5:15:31:af:ee:63:bd:3e:73:57:a7:65:d0:63:dfSigner

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 1.3MB - Virtual size: 1.3MB

DATA Size: 85KB - Virtual size: 84KB

BSS Size: - Virtual size: 28KB

.idata Size: 15KB - Virtual size: 15KB

.edata Size: 1024B - Virtual size: 615B

.tls Size: - Virtual size: 235B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 78KB - Virtual size: 78KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

04:00:00:00:00:01:15:4b:5a:c3:94
Certificate

04:00:00:00:00:01:23:9e:0f:ac:b3
Certificate

01:00:00:00:00:01:30:32:33:50:83
Certificate

04:00:00:00:00:01:23:9e:0f:af:24
Certificate

f1:de:c8:a5:e6:e5:15:31:af:ee:63:bd:3e:73:57:a7:65:d0:63:df
Signer

CODE
Size: 1.3MB - Virtual size: 1.3MB

DATA
Size: 85KB - Virtual size: 84KB

BSS
Size: - Virtual size: 28KB

.idata
Size: 15KB - Virtual size: 15KB

.edata
Size: 1024B - Virtual size: 615B

.tls
Size: - Virtual size: 235B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 78KB - Virtual size: 78KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB