General

  • Target

    bdd7d90162325f44ead3310f6b9c2bf8f81ac4f02a49810e42e4f73bce617134.7z

  • Size

    540KB

  • Sample

    241227-c8l3vazqcj

  • MD5

    d864c45886d4d0746a8307c23b7c661f

  • SHA1

    c6c84389d5ca47f14f2e75f636fa8291a54a524b

  • SHA256

    bdd7d90162325f44ead3310f6b9c2bf8f81ac4f02a49810e42e4f73bce617134

  • SHA512

    b3db1fd019ab672046b008340b78864cd539f57f4e3bd5b7b4db28c93c76842ba29ea93e8a06eeca50b50373c2dcf4d585462fb7a1e9178e72bf887129d1bc76

  • SSDEEP

    12288:cYaM6pKN27iQBfDRUsBkz3EHh4/7NAbUAHk9Q9j+YBSQBMtzx:cO2GQBfdSz57ybUYjDHSl

Malware Config

Targets

    • Target

      Delivery form - Airway bill details - Tracking info 45821631127I ,pdf.scr

    • Size

      1.4MB

    • MD5

      9e67c73f86b034d009280ab03db20124

    • SHA1

      aba6a0de8e85cf5a84c0a158d3908189ecf29330

    • SHA256

      b55cf6b5ec66fdc4dbbecc4e2f7698549964ec234bd0b55d057527d59d91147d

    • SHA512

      22ecfa7f450a2edbdb964a900524069f9b12804d691d204eda66efb6c2eb212e8e81229cc5e27626ea699749a72107adb45fce5a7ae4dd21f7fe4d4ea33ab9ff

    • SSDEEP

      24576:Gae+1jKFTxeZhauIhY8oYsO0COg21wu0L8U:Ge16FeGrI/g21W8U

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Modiloader family

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.