Extracted

Extracted

• • Target

    ce3681ec2e62af9f0231b1a32a7319766d8193d0ff86c69691176f4cd404f129.doc

  • Size

    143KB

  • MD5

    059f7753a76e86c8ed56f480041d631f

  • SHA1

    c356187bee23b8930e82ba2cea112873b39567d4

  • SHA256

    ce3681ec2e62af9f0231b1a32a7319766d8193d0ff86c69691176f4cd404f129

  • SHA512

    94ce1aff40a57a963dabec69fbc969dbc27ff7289ca07a21233379a415cca52fbc69cbab722afef149077ab3647798192332b6afd5500d3189206728dc22f81b

  • SSDEEP

    1536:17dgmjjy2lQkySTUb2roegTK+g9WomfaQjSqttJnkL5mS9kBwNR42q3V:1ZPjbTU+J799IjSqtteL5N9kBF2

  Score

  10^/10

  modiloaderdiscoverytrojanvipkeyloggercollectionkeyloggerpersistencespywarestealer

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modiloader family

    modiloader

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • ModiLoader Second Stage

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2