Overview

overview

10

Static

static

3

625b3c4b04...6c.exe

windows7-x64

10

625b3c4b04...6c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    625b3c4b0442f8e6b0b6d9e10aafe96c.exe

  • Size

    1.2MB

  • Sample

    241213-hqxphs1pdy

  • MD5

    625b3c4b0442f8e6b0b6d9e10aafe96c

  • SHA1

    a5361ee3adda99f15e77447d0b9db02f359f4b81

  • SHA256

    3c20f8f6aa5f1c960bbf6a758112c1cc17ac5a07b769e1e4b3300d685583a7b8

  • SHA512

    757a67d1dc4ab0cf348f6fd577f9c3a086c8c7b8b0ef207022a0416cd9f070b845498c27ec31894a49312d1a0289f6eaf2aa781aba48e8e7a64fb63ea0bbad45

  • SSDEEP

    24576:zPMPVEhH8frMNVO1wyWYVtcqqvHP7R3Eb1v7kxER8:zPUyOShq0HFA7mER8

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      625b3c4b0442f8e6b0b6d9e10aafe96c.exe

    • Size

      1.2MB

    • MD5

      625b3c4b0442f8e6b0b6d9e10aafe96c

    • SHA1

      a5361ee3adda99f15e77447d0b9db02f359f4b81

    • SHA256

      3c20f8f6aa5f1c960bbf6a758112c1cc17ac5a07b769e1e4b3300d685583a7b8

    • SHA512

      757a67d1dc4ab0cf348f6fd577f9c3a086c8c7b8b0ef207022a0416cd9f070b845498c27ec31894a49312d1a0289f6eaf2aa781aba48e8e7a64fb63ea0bbad45

    • SSDEEP

      24576:zPMPVEhH8frMNVO1wyWYVtcqqvHP7R3Eb1v7kxER8:zPUyOShq0HFA7mER8

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks