Overview

overview

10

Static

static

1

PO#3_RKG367.bat

windows7-x64

10

PO#3_RKG367.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aaaaaaaaa.zip

  • Size

    633KB

  • Sample

    241228-rlh51ayphr

  • MD5

    f33ca9d1e5fdee64a7efaab18bdcd1f4

  • SHA1

    0cab3d4cdd97d8be6ee530ef86b3bacbff74612a

  • SHA256

    34b64b3bef995a063b8b8aa863d8f4ef476f0a260ae15b124f03cc2680f79d46

  • SHA512

    04a1e53b1d6e2252a65dfca084a27ba00578fa0d5688fd1fc6df148017d0ae69e44d46b3d391898ef25a1e1f8fc357e6fbe18b0f0b12b62c478c2f55e619a74c

  • SSDEEP

    12288:GIo2R9dLKs+QmpJIwRKvUraL7UU9+JzzFm4jXXXL/x+XaASos4w+o:/9yRpTEHLGxzFjXX1+Xahxb

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      PO#3_RKG367.bat

    • Size

      2.1MB

    • MD5

      deaa9cb6ee189b95d1ad718df32dac56

    • SHA1

      ba94e1e97609cfa1bd102fe1087fc714875c6c25

    • SHA256

      8f721d0dc987c60cb16a14ad166eab606b1b9401d6563241eb8ed359c24ad201

    • SHA512

      02908f9c7ce3a1d53af14de4465744585b23d31e99e08d2a64030f60eac5da5505c93e5fe4de91aeb77b85377d57b047ed8a5d5262fd08dcffa30943b0bb88e1

    • SSDEEP

      49152:dCPDyxXvtkfpoX/xXGkA++z8+j+Dl+T++evHN+C2+1r+E++eaU++p+++7C+z+++q:n

    Score
    10/10
    modiloaderdiscoverytrojanpersistence

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks