Overview

overview

10

Static

static

3

Ordine PO ...df.scr

windows7-x64

10

Ordine PO ...df.scr

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    03a1f9b76c7adc4853e53d27bf7c5c08459de6ffc9b50b229cec877090cbab8d.7z.bin

  • Size

    771KB

  • Sample

    241223-rxhzdaslfj

  • MD5

    1a5431fd61a8d925981c2c43aa60d8ac

  • SHA1

    05403103f4a66da4e4046ffa5448dbacbb580900

  • SHA256

    03a1f9b76c7adc4853e53d27bf7c5c08459de6ffc9b50b229cec877090cbab8d

  • SHA512

    02556a1a276f67fe528c048d4b25de91fc2b0fc45be1f0c49abea99515bb611b70d6acd9b26d4d4199bda8e41e1479463f2b4393a2fafc422081c93747509bc4

  • SSDEEP

    24576:SpFq3OF3Ej6WldD4pAbK7TK2pvxufwP0zRA/SRc:i54lbpb/wvvmc

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      Ordine PO - 4R22R8911C, 4R22R8911D ,pdf.scr

    • Size

      1.5MB

    • MD5

      f8b6c70a2bce26b26eb4637f69be066b

    • SHA1

      fa8682bbeddec9064e4765bb3fb013e37db21489

    • SHA256

      34aaa057e9095d5ac4d07aef30be548993c1ac8a1f84b9f025eb3bf8e1697ec5

    • SHA512

      9f24571a08e8c9adac71983c4f59665977499dc88f44d74eb42fab1cbd2df1a07cd2edf819bd16b231b723a25512210386593627e7194d41a0218939298bffae

    • SSDEEP

      24576:ybzkvy/WQ9JGhRg8MLr12geV421wu0L8UnE923HZshmMv6J:ybzgZh+HV21W8UE923HZrs6

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks