modiloader | 3cad10488e9efd31ba0fe6cacc311572a2fac4c4760b315e5ce337ea731ce22c | Triage

Sharing

General

Target

SecuriteInfo.com.AI.Packer.F6FD72BA21.14573
Size

649KB
Sample

200708-gxkw2m7cya
MD5

3c37c322eabf6eda7375d85e15e3c6e3
SHA1

a6cf2cbcf8aee310c4bde6b846a83a91b3855c46
SHA256

3cad10488e9efd31ba0fe6cacc311572a2fac4c4760b315e5ce337ea731ce22c
SHA512

dfb235f3db2401554e070dc4ba6add57360e8a3327537f83c9fb6397d2b87fae614dba67888ce286f9b8beaab3b34ca903b7bf0bae7705d7402e6615d4822757

Score

10^/10

modiloader remcos persistence rat trojan

Malware Config

Targets

- Target
  
  SecuriteInfo.com.AI.Packer.F6FD72BA21.14573
- Size
  
  649KB
- MD5
  
  3c37c322eabf6eda7375d85e15e3c6e3
- SHA1
  
  a6cf2cbcf8aee310c4bde6b846a83a91b3855c46
- SHA256
  
  3cad10488e9efd31ba0fe6cacc311572a2fac4c4760b315e5ce337ea731ce22c
- SHA512
  
  dfb235f3db2401554e070dc4ba6add57360e8a3327537f83c9fb6397d2b87fae614dba67888ce286f9b8beaab3b34ca903b7bf0bae7705d7402e6615d4822757
Score

10^/10

modiloader remcos persistence rat trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Tasks

static1

behavioral1

modiloaderremcospersistencerattrojan

behavioral2

modiloaderpersistencetrojan