Extracted

• • Target

    END-SPECIFICATION,PDF.js

  • Size

    1.2MB

  • MD5

    a2b6e68b10d47ce2239cba7094c44d6c

  • SHA1

    0484c998965c61654de6bd7c0f19d602a43d4710

  • SHA256

    441c59f9b21b7030922e2fbe815ac9a9247da921dadbfd5aa8d56aec956382fb

  • SHA512

    1a954da6158ff831bd364fddafc974646a88191be3bc8d313a305fe97b7243a1bec957db1cd1f5ee7710d9330822023d2e80a3d538ec8f96df44a043f4d4f074

  • SSDEEP

    24576:BhHitPIlN14h1EWUPoNfkljva8wkIvmdHJGHpT86b0avp4kJL7a5ZKCmjLpvn:oR1lUPompvCSdvkw5wh

  Score

  10^/10

  modiloaderdiscoveryexecutiontrojanpersistencespywarestealer

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modiloader family

    modiloader

  • ModiLoader Second Stage

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    ENQ-RET-402-1438,PDF.vbs

  • Size

    1.2MB

  • MD5

    a92a052a628a229a76accbff7ee84396

  • SHA1

    e8930025f173138403a5c6ff443bff68bf0cfa32

  • SHA256

    1eab6be3203ff067848bab4f352281409756fef36927e3f4611ff85504d716ef

  • SHA512

    4069b68563417f4856ee9fc01da9b5ee3bcfc8f81262d0e3f75af8ecfbd056baea7310d469aeb937200b966a5e50d638873b6d8a5bc599ef575826c712892656

  • SSDEEP

    24576:rhHitPIlN14h1EWUPoNfkljva8wkIvmdHJGHpT86b0avp4kJL7a5ZKCmjLpvr:iR1lUPompvCSdvkw5wl

  Score

  10^/10

  modiloaderdiscoverytrojanpersistence

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modiloader family

    modiloader

  • ModiLoader Second Stage

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral3behavioral4