Overview

overview

10

Static

static

1

a8f92f9141...01.chm

windows7-x64

10

a8f92f9141...01.chm

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a8f92f91412bcf71275883d86a3df7fdcc29d7ac3104f261e6e5d71f033ee101.chm

  • Size

    75KB

  • Sample

    250121-d3v91atrgz

  • MD5

    92588daadcf11b3311b82e8b20219340

  • SHA1

    68c690da91c4a1cb0e7336b055ea87877a7b8b9d

  • SHA256

    a8f92f91412bcf71275883d86a3df7fdcc29d7ac3104f261e6e5d71f033ee101

  • SHA512

    38fa50cfad7f030712b9c8a81af995b0319075aa5e9ba3768d799bf13aa0532130d491bb6d90d0c8fbc2e8ffacc31e85629152d3281d4818eb8716d0f16cd523

  • SSDEEP

    1536:PRReoi9mRqozQM8I3FInJQqcN8HSsIN2i5reqgdMb0OYqFHPf:5Rez9kTAoFI7jq2i6qgGbzYOn

Score
10/10
modiloaderdefense_evasiondiscoveryexecutionpersistencetrojan

Malware Config

Targets

    • Target

      a8f92f91412bcf71275883d86a3df7fdcc29d7ac3104f261e6e5d71f033ee101.chm

    • Size

      75KB

    • MD5

      92588daadcf11b3311b82e8b20219340

    • SHA1

      68c690da91c4a1cb0e7336b055ea87877a7b8b9d

    • SHA256

      a8f92f91412bcf71275883d86a3df7fdcc29d7ac3104f261e6e5d71f033ee101

    • SHA512

      38fa50cfad7f030712b9c8a81af995b0319075aa5e9ba3768d799bf13aa0532130d491bb6d90d0c8fbc2e8ffacc31e85629152d3281d4818eb8716d0f16cd523

    • SSDEEP

      1536:PRReoi9mRqozQM8I3FInJQqcN8HSsIN2i5reqgdMb0OYqFHPf:5Rez9kTAoFI7jq2i6qgGbzYOn

    Score
    10/10
    modiloaderdefense_evasiondiscoveryexecutionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Hide Artifacts: Hidden Window

      Windows that would typically be displayed when an application carries out an operation can be hidden.

      defense_evasion

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks