General
-
Target
3b1dc7e0c9154fe384c695f8eec5622ab2ba88bf59d990def6b2c11d8519cecf
-
Size
1.6MB
-
Sample
201121-rkr8khz95j
-
MD5
3c92d4e743bd7d72ea967445fee5cdf8
-
SHA1
d00b20bfaf832d479cdfc23168de03c3e8209468
-
SHA256
3b1dc7e0c9154fe384c695f8eec5622ab2ba88bf59d990def6b2c11d8519cecf
-
SHA512
4349e789033c1c31858ab73865a341d12ed5e9c6542da620a889ca1af094ec92804587130936b50c8329335c3df649d758084ab96783a132a4d649918f4a1c20
Static task
static1
Behavioral task
behavioral1
Sample
3b1dc7e0c9154fe384c695f8eec5622ab2ba88bf59d990def6b2c11d8519cecf.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
3b1dc7e0c9154fe384c695f8eec5622ab2ba88bf59d990def6b2c11d8519cecf.exe
Resource
win10v20201028
Malware Config
Targets
-
-
Target
3b1dc7e0c9154fe384c695f8eec5622ab2ba88bf59d990def6b2c11d8519cecf
-
Size
1.6MB
-
MD5
3c92d4e743bd7d72ea967445fee5cdf8
-
SHA1
d00b20bfaf832d479cdfc23168de03c3e8209468
-
SHA256
3b1dc7e0c9154fe384c695f8eec5622ab2ba88bf59d990def6b2c11d8519cecf
-
SHA512
4349e789033c1c31858ab73865a341d12ed5e9c6542da620a889ca1af094ec92804587130936b50c8329335c3df649d758084ab96783a132a4d649918f4a1c20
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader First Stage
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of SetThreadContext
-