Overview

overview

10

Static

static

1

INQUIRY LIST 292.vbs

windows7-x64

10

INQUIRY LIST 292.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    INQUIRY LIST 292.vbs

  • Size

    1.1MB

  • Sample

    250117-nlvx1svpe1

  • MD5

    2f5edacbfdae7a51267deeb8e937bfec

  • SHA1

    d0ce895b7a4e55fe7f12121878a5818850f1dc00

  • SHA256

    07898f8cb7e07bd6b86fd09cfff5898eb246a44524b3dda7a39e3de32667490b

  • SHA512

    fb8c8d268dd5f4b0c619213a0c36c3132574d04c8780eb4c5623af08c7aea7d12fdc1dcab4903908b099b2874a34f8d9804af746978a93af488a95a101d0d392

  • SSDEEP

    24576:uR3Gv4DQo4o3Hj6R3EpqvdG5Np4kJL7a5ZKCmjLpvi:HBo4o3kE4w2kw5w4

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      INQUIRY LIST 292.vbs

    • Size

      1.1MB

    • MD5

      2f5edacbfdae7a51267deeb8e937bfec

    • SHA1

      d0ce895b7a4e55fe7f12121878a5818850f1dc00

    • SHA256

      07898f8cb7e07bd6b86fd09cfff5898eb246a44524b3dda7a39e3de32667490b

    • SHA512

      fb8c8d268dd5f4b0c619213a0c36c3132574d04c8780eb4c5623af08c7aea7d12fdc1dcab4903908b099b2874a34f8d9804af746978a93af488a95a101d0d392

    • SSDEEP

      24576:uR3Gv4DQo4o3Hj6R3EpqvdG5Np4kJL7a5ZKCmjLpvi:HBo4o3kE4w2kw5w4

    Score
    10/10
    modiloaderdiscoverytrojanpersistence

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks