Overview

overview

10

Static

static

3

BANK_SWIFT_USD.exe

windows7-x64

3

BANK_SWIFT_USD.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    nBANK_SWIFT_USD.tar

  • Size

    521KB

  • Sample

    250123-nrpyysymdx

  • MD5

    d9a4a241b54644f3f416dd18cab40641

  • SHA1

    035056dd4e94c480eb0aaf9b95ffa70b64335181

  • SHA256

    f4515e37cb825f98a02a4e2c74086fcdead45fd4358fcd461b894c00bdc44922

  • SHA512

    291965d629e3763fb9e7dce7a94ac6671488e16aa8a5640ef049e1d23dbef0509c17cb5acb4c8f42c28d69a396c0c75d1bd9ac0ce62d9448215a2b9ee6823ecb

  • SSDEEP

    12288:DLCbQsUIsEY1DNetynX02pIBtAO5NtzaWGXgNd6DWlic:DubxUIaWynEnt15NlIzWYc

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      BANK_SWIFT_USD.exe

    • Size

      1.3MB

    • MD5

      e1c02c1d4632b25e53d62d7c93ec6888

    • SHA1

      f0818dbc450af307a2e353d7de6a5b42c95264d7

    • SHA256

      a3d49aa02f3249b3a41dae94f3b181a205b954e8ad7e4acc1bccf7de535b8c6f

    • SHA512

      a20c7d5615cbad44151d76f35e6d38f55095ee77be2ccbdcdfde0544f83ecaa15b274676158526fbc6cadd1b7dece9b23f0dea161cceb9cbb4fdfc650c714240

    • SSDEEP

      24576:JUWe1lsIh7u57Mhl0Siz+h4dYEXvVzlFjG31di:JClztlpiz+adRvVR2D

    Score
    10/10
    discoverymodiloaderpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks