| 哈希 / 信息 | 值 |
|---|---|
| SHA256 | b1aec011f8cf2219852c6094d67063dbaf74640e9c0185097e1f0cb59ae3ffa2 |
| MD5 | 4e716d0e8ada759403d79c9d9c5de4c4 |
| SHA1 | 69b6cba3665603a4b9ab3be81157502015c6a14d |
| ImpHash | b994e2b35fac0eca9b95949a165480a1 |
| 文件 Adi | PURCHASE.EXE |
| 文件类型 | exe |
| 大小 | 860,672 bytes |
| 首次发现 | 2023-05-19 |
Tehdit 值lendirmesi
Bu ornek, hedef sisteme ek zararlı yazılım yuklemek amacıyla tasarlanmis moduler bir yukleyici (loader) olarak tespit edilmistir. Bankacılık trojanları, fidye yazılımları veya diger ikinci asama yukler indirebilmektedir.
检测到的功能
- Payload Indirme
- Surec Enjeksiyonu
- Kalicilik
- Anti-Analiz
- Sifrelenmis Iletisim
MalwareBazaar 标签
分析说明
Bu ornek ModiLoader ailesine ait ve MalwareBazaar platformundan alınmıstır. KEYDAL Guvenlik Arastirmaları tarafından metadata analizi gerceklestirilmis ve IOC veritabanına eklenmistir.
ModiLoader — 恶意软件档案
ModiLoader. TFG0890000001.exe logistics lure. Microsoft.TeamFoundation Azure DevOps SDK embedded. MySql.Data.MySqlClient MySQL connector. Possible Azure DevOps C2 channel.
技术细节
Varyanta gore C/C#/VBS/PS1, anti-analysis (VM/debugger check), persistence (Registry/Task Scheduler/Startup folder), payload decryption ve injection (shellcode/PE), fileless execution teknikleri
能力与行为
IOC列表 (6 个指标)
# SHA256
b1aec011f8cf2219852c6094d67063dbaf74640e9c0185097e1f0cb59ae3ffa2
# MD5
4e716d0e8ada759403d79c9d9c5de4c4
# DOMAIN
modi-loader.com
# DOMAIN
modi-cdn-eu.com
# MUTEX
GlobalModiLoader_M3T4
# FILEPATH
%APPDATA%MicrosoftWindowsStart MenuProgramsStartup
undll32.exe
| 类型 | 值 | 备注 |
|---|---|---|
| sha256 | b1aec011f8cf2219852c6094d67063dbaf74640e9c0185097e1f0cb59ae3ffa2 | |
| md5 | 4e716d0e8ada759403d79c9d9c5de4c4 | |
| domain | modi-loader.com | ModiLoader C2 domain |
| domain | modi-cdn-eu.com | ModiLoader Avrupa dagitim domain |
| mutex | GlobalModiLoader_M3T4 | ModiLoader mutex |
| filepath | %APPDATA%MicrosoftWindowsStart MenuProgramsStartup undll32.exe | ModiLoader startup persistence |