Overview

overview

10

Static

static

1

PO_2024_05...045.gz

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO_2024_056209_MQ04865_ENQ_1045.GZ

  • Size

    943KB

  • Sample

    241231-dcbgxazrck

  • MD5

    6271861abdb95e51f6849c843acdae62

  • SHA1

    66cc315ad98bd5bae2ffb11729bbfdae8eefa85a

  • SHA256

    aae8699a908c3ca5211006647460cb8eb15c517a7cbf4a45bbf7909977317faf

  • SHA512

    90a117bbfc1251361d0e8900675c6846511598544dd1df0d3eb6b2ec982a5b83bea4b81eeee9991ca84cdc44785573bc9e79eff9ff417f747990e635a42f59fb

  • SSDEEP

    24576:yKMYBN1/giWrlz3+rRu+P+FBVIceG7VX6BUxWDbuLmfq/wTL:1MI/giUlr+rRu+2FE5G7VKCxlLmS/wX

Score
10/10
modiloadercollectiondiscoverypersistencespywarestealertrojan

Malware Config

Targets

    • Target

      PO_2024_056209_MQ04865_ENQ_1045.GZ

    • Size

      943KB

    • MD5

      6271861abdb95e51f6849c843acdae62

    • SHA1

      66cc315ad98bd5bae2ffb11729bbfdae8eefa85a

    • SHA256

      aae8699a908c3ca5211006647460cb8eb15c517a7cbf4a45bbf7909977317faf

    • SHA512

      90a117bbfc1251361d0e8900675c6846511598544dd1df0d3eb6b2ec982a5b83bea4b81eeee9991ca84cdc44785573bc9e79eff9ff417f747990e635a42f59fb

    • SSDEEP

      24576:yKMYBN1/giWrlz3+rRu+P+FBVIceG7VX6BUxWDbuLmfq/wTL:1MI/giUlr+rRu+2FE5G7VKCxlLmS/wX

    Score
    10/10
    modiloadercollectiondiscoverypersistencespywarestealertrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks