| ハッシュ / 情報 | 値 |
|---|---|
| SHA256 | b1aec011f8cf2219852c6094d67063dbaf74640e9c0185097e1f0cb59ae3ffa2 |
| MD5 | 4e716d0e8ada759403d79c9d9c5de4c4 |
| SHA1 | 69b6cba3665603a4b9ab3be81157502015c6a14d |
| ImpHash | b994e2b35fac0eca9b95949a165480a1 |
| ファイル Adi | PURCHASE.EXE |
| ファイル種別 | exe |
| サイズ | 860,672 bytes |
| 初回確認 | 2023-05-19 |
Tehdit 値lendirmesi
Bu ornek, hedef sisteme ek zararlı yazılım yuklemek amacıyla tasarlanmis moduler bir yukleyici (loader) olarak tespit edilmistir. Bankacılık trojanları, fidye yazılımları veya diger ikinci asama yukler indirebilmektedir.
検出された機能
- Payload Indirme
- Surec Enjeksiyonu
- Kalicilik
- Anti-Analiz
- Sifrelenmis Iletisim
MalwareBazaar タグ
解析メモ
Bu ornek ModiLoader ailesine ait ve MalwareBazaar platformundan alınmıstır. KEYDAL Guvenlik Arastirmaları tarafından metadata analizi gerceklestirilmis ve IOC veritabanına eklenmistir.
ModiLoader — マルウェアプロファイル
ModiLoader. TFG0890000001.exe logistics lure. Microsoft.TeamFoundation Azure DevOps SDK embedded. MySql.Data.MySqlClient MySQL connector. Possible Azure DevOps C2 channel.
技術詳細
Varyanta gore C/C#/VBS/PS1, anti-analysis (VM/debugger check), persistence (Registry/Task Scheduler/Startup folder), payload decryption ve injection (shellcode/PE), fileless execution teknikleri
機能と挙動
IOCリスト (6 件の指標)
# SHA256
b1aec011f8cf2219852c6094d67063dbaf74640e9c0185097e1f0cb59ae3ffa2
# MD5
4e716d0e8ada759403d79c9d9c5de4c4
# DOMAIN
modi-loader.com
# DOMAIN
modi-cdn-eu.com
# MUTEX
GlobalModiLoader_M3T4
# FILEPATH
%APPDATA%MicrosoftWindowsStart MenuProgramsStartup
undll32.exe
| タイプ | 値 | メモ |
|---|---|---|
| sha256 | b1aec011f8cf2219852c6094d67063dbaf74640e9c0185097e1f0cb59ae3ffa2 | |
| md5 | 4e716d0e8ada759403d79c9d9c5de4c4 | |
| domain | modi-loader.com | ModiLoader C2 domain |
| domain | modi-cdn-eu.com | ModiLoader Avrupa dagitim domain |
| mutex | GlobalModiLoader_M3T4 | ModiLoader mutex |
| filepath | %APPDATA%MicrosoftWindowsStart MenuProgramsStartup undll32.exe | ModiLoader startup persistence |