Overview

overview

10

Static

static

3

8a63bbd795...35.exe

windows7-x64

10

8a63bbd795...35.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8a63bbd795519e52538e95891f205d78a4ccc474c24e80d8efab364ad4ca2335.exe

  • Size

    1.5MB

  • Sample

    241225-cx838svmhj

  • MD5

    aaca1b72e0ac5dc118b0f981667e8179

  • SHA1

    162a85d0d2d6eec0fb05d043167bbd8451183735

  • SHA256

    8a63bbd795519e52538e95891f205d78a4ccc474c24e80d8efab364ad4ca2335

  • SHA512

    b066f98aa3ff546753e6ac2cc76918ab90b46859ecadb7b1940bf562edbb389383f2a09146b71863073c3434a408daf5fa93968603011d647ede2aa9c9e13426

  • SSDEEP

    24576:ybzkvy/WQ9JGhRg8MLr12geV421wu0L8UnE923HZshmMv6J:ybzgZh+HV21W8UE923HZrs6

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      8a63bbd795519e52538e95891f205d78a4ccc474c24e80d8efab364ad4ca2335.exe

    • Size

      1.5MB

    • MD5

      aaca1b72e0ac5dc118b0f981667e8179

    • SHA1

      162a85d0d2d6eec0fb05d043167bbd8451183735

    • SHA256

      8a63bbd795519e52538e95891f205d78a4ccc474c24e80d8efab364ad4ca2335

    • SHA512

      b066f98aa3ff546753e6ac2cc76918ab90b46859ecadb7b1940bf562edbb389383f2a09146b71863073c3434a408daf5fa93968603011d647ede2aa9c9e13426

    • SSDEEP

      24576:ybzkvy/WQ9JGhRg8MLr12geV421wu0L8UnE923HZshmMv6J:ybzgZh+HV21W8UE923HZrs6

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks