Overview

overview

10

Static

static

1

AVSL-00467...21.chm

windows7-x64

8

AVSL-00467...21.chm

windows10-2004-x64

10

Resubmissions

15-01-2025 16:20

250115-ttetnazjfk 3

15-01-2025 15:00

250115-sdde8awlfy 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2756869dcb28558efa87f421ed3bcbfe371028ef8dce5a33513fdc299a6aec08

  • Size

    67KB

  • Sample

    250115-sdde8awlfy

  • MD5

    bc3b706a723c36f2a4cc3e8dc8a171ea

  • SHA1

    687a24de7eb03e0ca1bdbb0453a9fa9c5ee80df1

  • SHA256

    2756869dcb28558efa87f421ed3bcbfe371028ef8dce5a33513fdc299a6aec08

  • SHA512

    e6dac405f8bccba3c9fe6a5b1200445a6f7885c323ef61351f53dab56da6e2b0d7c425c6f0eba5d0fe35e211f8f0f614d30692c52278a6088b0bcbbed6deb070

  • SSDEEP

    1536:5pAI+sLa+cWhou4327/9AbCfkFLStN1ocGQPGYQ+y9j:5GI+Wpbhv79kCMUbK3QDQ+e

Score
10/10
modiloaderdefense_evasiondiscoveryexecutionpersistencetrojan

Malware Config

Targets

    • Target

      AVSL-004673321/AVSL-004673321.chm

    • Size

      75KB

    • MD5

      98ea3f95d115f45570febc7a1872b1a7

    • SHA1

      a0985ee5bba1ed9ea30a4422c4007d35efde92d2

    • SHA256

      94492a4bfc8998c413bd30023b60427b394e5950eed33373f07faaf863c1d3f3

    • SHA512

      cbd8258068e3d25a682d9402a68adf5b9f8fba7414545b86af1e801c705dca4c77b5df77696b867cddf20f803f4cb599f472d3e76202df2dd1e75471b15afd86

    • SSDEEP

      1536:4pVD2VwAO+rou4327/9AbCtkFLStN1osGQPGYQ+yV:uVgbO+rv79kCOUbKnQDQ+C

    Score
    10/10
    defense_evasiondiscoveryexecutionmodiloaderpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Hide Artifacts: Hidden Window

      Windows that would typically be displayed when an application carries out an operation can be hidden.

      defense_evasion

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Hide Artifacts

1
T1564

Hidden Window

1
T1564.003

Modify Registry

3
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Query Registry

1
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks