Overview

overview

10

Static

static

3

Airwaybill...cr.exe

windows7-x64

10

Airwaybill...cr.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Airwaybilldetails-DeliveryreceiptContactFormno_45987165927pdf.scr.exe

  • Size

    1.3MB

  • Sample

    241230-l2qxwsxldv

  • MD5

    09f4f91713bd6588465534822d5ad96c

  • SHA1

    3b6b69c8709aea821d60248294d52e3cfefecb23

  • SHA256

    c8e0836b1e1ea4ee7486eb41994ae198cb5f60f460dc4cbefbbabc186329855f

  • SHA512

    8b6b9ad29f50a6e141c8a3033d0f668abf63207497ec4a8ba469d5ce08a2ab9a93a06c66cc2e57e614a45d0e188eb0a6f5e94e578c3525c127a4e288a494a774

  • SSDEEP

    24576:9dk7eYEWx0i5VTe5QCQBSt2jKasCr4LUkq0uHyC6q7KubU+7:90eYbSGUelD0uSC6q7bbU+

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      Airwaybilldetails-DeliveryreceiptContactFormno_45987165927pdf.scr.exe

    • Size

      1.3MB

    • MD5

      09f4f91713bd6588465534822d5ad96c

    • SHA1

      3b6b69c8709aea821d60248294d52e3cfefecb23

    • SHA256

      c8e0836b1e1ea4ee7486eb41994ae198cb5f60f460dc4cbefbbabc186329855f

    • SHA512

      8b6b9ad29f50a6e141c8a3033d0f668abf63207497ec4a8ba469d5ce08a2ab9a93a06c66cc2e57e614a45d0e188eb0a6f5e94e578c3525c127a4e288a494a774

    • SSDEEP

      24576:9dk7eYEWx0i5VTe5QCQBSt2jKasCr4LUkq0uHyC6q7KubU+7:90eYbSGUelD0uSC6q7bbU+

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks