Overview

overview

10

Static

static

3

06f565d6af...2N.exe

windows7-x64

10

06f565d6af...2N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe

  • Size

    112KB

  • Sample

    250120-fd62baslek

  • MD5

    045a6f44159b9387c82e5a9c97884b00

  • SHA1

    3ee35fbfbe71368b145def491cd26b77724bd592

  • SHA256

    06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2

  • SHA512

    1bc0fca5554eeca0994fdc27911648193376dcd4dea2996e64777b4415d63112ff3c35b583e1b9daf002a95e0aa9fd1979ae69e05487297355b87a4badaa9b53

  • SSDEEP

    1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ5:tVIr7zI+fAceoGxSKKo55

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2N.exe

    • Size

      112KB

    • MD5

      045a6f44159b9387c82e5a9c97884b00

    • SHA1

      3ee35fbfbe71368b145def491cd26b77724bd592

    • SHA256

      06f565d6af41620c4d10398fb19c1b778f1701fd5e950a2216a5cfc6fe4589f2

    • SHA512

      1bc0fca5554eeca0994fdc27911648193376dcd4dea2996e64777b4415d63112ff3c35b583e1b9daf002a95e0aa9fd1979ae69e05487297355b87a4badaa9b53

    • SSDEEP

      1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ5:tVIr7zI+fAceoGxSKKo55

    Score
    10/10
    modiloaderdiscoverytrojanupxpersistence

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks