Overview

overview

10

Static

static

3

a07c3917cc...7N.exe

windows7-x64

10

a07c3917cc...7N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a07c3917cc4af59368bf312fd5b52a431a07b0d27671606bf5ff9d57907cee77N.exe

  • Size

    1.5MB

  • Sample

    250101-v16rdsxmgp

  • MD5

    604d44b34c84a06e2cbbb85be1bce840

  • SHA1

    22f270b7a0b9008f24d57cfbe7a9e28f1acbd021

  • SHA256

    a07c3917cc4af59368bf312fd5b52a431a07b0d27671606bf5ff9d57907cee77

  • SHA512

    a0f1b3394f6a1ad1df35dec07a84db4a76370c41e84b619072b47b0c11634377fcc44428641e9136ac2c45172ba3420a07cd1bd786cbaab2239076b9d89de5fc

  • SSDEEP

    24576:ybzkvy/WQ9JGhRg8MLr12geV421wu0L8UnE923HZshmMv6J:ybzgZh+HV21W8UE923HZrs6

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      a07c3917cc4af59368bf312fd5b52a431a07b0d27671606bf5ff9d57907cee77N.exe

    • Size

      1.5MB

    • MD5

      604d44b34c84a06e2cbbb85be1bce840

    • SHA1

      22f270b7a0b9008f24d57cfbe7a9e28f1acbd021

    • SHA256

      a07c3917cc4af59368bf312fd5b52a431a07b0d27671606bf5ff9d57907cee77

    • SHA512

      a0f1b3394f6a1ad1df35dec07a84db4a76370c41e84b619072b47b0c11634377fcc44428641e9136ac2c45172ba3420a07cd1bd786cbaab2239076b9d89de5fc

    • SSDEEP

      24576:ybzkvy/WQ9JGhRg8MLr12geV421wu0L8UnE923HZshmMv6J:ybzgZh+HV21W8UE923HZrs6

    Score
    10/10
    modiloaderdiscoverytrojanpersistence

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks