modiloader | 34b64b3bef995a063b8b8aa863d8f4ef476f0a260ae15b124f03cc2680f79d46

General

Target

aaaaaaaaa.zip
Size

633KB
Sample

241228-rhl3gsykh1
MD5

f33ca9d1e5fdee64a7efaab18bdcd1f4
SHA1

0cab3d4cdd97d8be6ee530ef86b3bacbff74612a
SHA256

34b64b3bef995a063b8b8aa863d8f4ef476f0a260ae15b124f03cc2680f79d46
SHA512

04a1e53b1d6e2252a65dfca084a27ba00578fa0d5688fd1fc6df148017d0ae69e44d46b3d391898ef25a1e1f8fc357e6fbe18b0f0b12b62c478c2f55e619a74c
SSDEEP

12288:GIo2R9dLKs+QmpJIwRKvUraL7UU9+JzzFm4jXXXL/x+XaASos4w+o:/9yRpTEHLGxzFjXX1+Xahxb

Score

10^/10

Malware Config

Targets

- Target
  
  PO#3_RKG367.bat
- Size
  
  2.1MB
- MD5
  
  deaa9cb6ee189b95d1ad718df32dac56
- SHA1
  
  ba94e1e97609cfa1bd102fe1087fc714875c6c25
- SHA256
  
  8f721d0dc987c60cb16a14ad166eab606b1b9401d6563241eb8ed359c24ad201
- SHA512
  
  02908f9c7ce3a1d53af14de4465744585b23d31e99e08d2a64030f60eac5da5505c93e5fe4de91aeb77b85377d57b047ed8a5d5262fd08dcffa30943b0bb88e1
- SSDEEP
  
  49152:dCPDyxXvtkfpoX/xXGkA++z8+j+Dl+T++evHN+C2+1r+E++eaU++p+++7C+z+++q:n
Score

10^/10

modiloader discovery trojan collection execution persistence spyware stealer
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2