Overview

overview

10

Static

static

3

1744309688...ed.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    17443096886cf549aafd4f50d83279c921b4238f3e10f892cdcfc3188c44093cfef3cd73b4448.dat-decoded.exe
  • Size 1.6MB
  • Sample250410-w4yevsyq18
  • SHA256 4e83dca9f0fc2e50b3c4b2abd8161e2ee5857286ae7bf9ffa5c789cdf2542052
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
modiloadercollectioncredential_accessdiscoverystealertrojan

Malware Config

Targets

    • Target
      17443096886cf549aafd4f50d83279c921b4238f3e10f892cdcfc3188c44093cfef3cd73b4448.dat-decoded.exe
    • Size 1.6MB
    • SHA256 4e83dca9f0fc2e50b3c4b2abd8161e2ee5857286ae7bf9ffa5c789cdf2542052
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    modiloadercollectioncredential_accessdiscoverystealertrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Executes dropped EXE

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks