ModiLoader, DBatLoader

ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

Modifies Windows Defender Real-time Protection settings

suricata: ET MALWARE PE EXE or DLL Windows file download Text

suricata: ET MALWARE PE EXE or DLL Windows file download Text

suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

suricata: ET MALWARE Win32/Delf.BLL Variant CnC Activity (Inbound)

suricata: ET MALWARE Win32/Delf.BLL Variant CnC Activity (Inbound)

suricata: ET MALWARE Win32/Delf.BLL Variant CnC Activity (Outbound)

suricata: ET MALWARE Win32/Delf.BLL Variant CnC Activity (Outbound)

ModiLoader First Stage

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.