Overview

overview

10

Static

static

3

TTClub Bil...cr.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TTClub Bill Of Lading - MIQOKHH009171 - S250002165.PDF.scr.exe

  • Size

    1.6MB

  • Sample

    250401-hpz39avygz

  • MD5

    ca6df1327b0ff637140b268c4bfe1b72

  • SHA1

    13c488fae638721a5485cfcd196d2b9e80c53cfd

  • SHA256

    061b716c6ca8262d658b5877cd23d1013e90831193da7e19cd03ca0f22b176bc

  • SHA512

    46247f611b655ed49255b678b350cf26eaa6062f5950662403ee0d4fb2aac632e6f4d4142843b1b582cb7782008add566458c1953835e84cc89833408301b4a2

  • SSDEEP

    24576:OkCIwKMTJndSh1pBODgqDx/u09m/FDwxXbdnA06Lsdb6Ul2:OkCzg0HD3TWsdb6U

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      TTClub Bill Of Lading - MIQOKHH009171 - S250002165.PDF.scr.exe

    • Size

      1.6MB

    • MD5

      ca6df1327b0ff637140b268c4bfe1b72

    • SHA1

      13c488fae638721a5485cfcd196d2b9e80c53cfd

    • SHA256

      061b716c6ca8262d658b5877cd23d1013e90831193da7e19cd03ca0f22b176bc

    • SHA512

      46247f611b655ed49255b678b350cf26eaa6062f5950662403ee0d4fb2aac632e6f4d4142843b1b582cb7782008add566458c1953835e84cc89833408301b4a2

    • SSDEEP

      24576:OkCIwKMTJndSh1pBODgqDx/u09m/FDwxXbdnA06Lsdb6Ul2:OkCzg0HD3TWsdb6U

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks