Overview

overview

10

Static

static

1

F.OPumpIstekDocx.bat

windows7-x64

10

F.OPumpIstekDocx.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    F.OPumpIstekDocx.bat

  • Size

    2.8MB

  • Sample

    241218-sk614stjbw

  • MD5

    0bdc3aeffe000c9c0c73a3faa2d001d8

  • SHA1

    1c8bc96bd0e00b21d734f936aeaea1e612442912

  • SHA256

    e11e4469c9c003f2b0074deada876e15f30afccae6178c5317e16cf5e6ee1ff6

  • SHA512

    6e577ecc9f09a106bfc32f81ece6e3277f3c02622d12205da0d8efbaf5602d86b6556ed2df576bad9de48c7908122d8ae35008c65ad868822b25b6543865fe83

  • SSDEEP

    24576:kH1yveXvtJNwYay5+kiD7Dm5c0B58llll8lUWtWJxM9bhHNfbTXr063u95fX7:kVyGftJ+YawbiS5BBUvzM9bhHNfnXm

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      F.OPumpIstekDocx.bat

    • Size

      2.8MB

    • MD5

      0bdc3aeffe000c9c0c73a3faa2d001d8

    • SHA1

      1c8bc96bd0e00b21d734f936aeaea1e612442912

    • SHA256

      e11e4469c9c003f2b0074deada876e15f30afccae6178c5317e16cf5e6ee1ff6

    • SHA512

      6e577ecc9f09a106bfc32f81ece6e3277f3c02622d12205da0d8efbaf5602d86b6556ed2df576bad9de48c7908122d8ae35008c65ad868822b25b6543865fe83

    • SSDEEP

      24576:kH1yveXvtJNwYay5+kiD7Dm5c0B58llll8lUWtWJxM9bhHNfbTXr063u95fX7:kVyGftJ+YawbiS5BBUvzM9bhHNfnXm

    Score
    10/10
    modiloaderdiscoverytrojanpersistence

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks