Overview

overview

10

Static

static

3

Delivery C...df.exe

windows7-x64

10

Delivery C...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    19122024_1045_18122024_DeliveryConfirmationForms-ContactFormTS4047117pdf.cab

  • Size

    599KB

  • Sample

    241219-m2sl6asjak

  • MD5

    fc5df1739d7a9a097bbf225820146039

  • SHA1

    7b9c1262a4bf54a7ed406601ca7c6ad0537feaae

  • SHA256

    093f7c1a7301dc6ed5a57ebeb3b65c7aa0e4dbaba5a0613f094780b7aba8655d

  • SHA512

    17f2e82f565a7cfaabb469aaa1b76ad2225db8042200e647a5907a38714fd4784da643e614ea5f6df1fb87b6be35e68e81396acebaa419335d747859224700c8

  • SSDEEP

    12288:aEVvUXkM7A1R7bHZ8Hrp7R+ebgD8aGFlXbDOKcwiKO40j+qsricY:8XkMM1xbHZ8LeHwagl+JtKOQqspY

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      Delivery Confirmation Forms - Contact Form TS4047117 pdf.exe

    • Size

      1.3MB

    • MD5

      72ab2a99902ec6f67b0d4df67820328e

    • SHA1

      31477040c90aab506547fe4e4450e71b76e9345b

    • SHA256

      406044ba7e007830321b3669505774b9e282502ac958f0cd723e5106c33c4180

    • SHA512

      3ff78c68e71f0bc2788f4177d7a49ff5857a71ec42d5e70c786f9cdea3a4b8ed1563fe95beef7501c8b6c85e96e06b63f5e5399575163b50bb6404bdec025cce

    • SSDEEP

      24576:TS1gzTBokW3THfYl7JTOs1r7FX2DOfqDrKfK8r/4mSwhODqR:TtTiq973f

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks