modiloader | 97d2e7808984018dd0cd0fbaa1232bd5c42c9cd042a317ca04e0fc2d0881f6cf

General

Target

97d2e7808984018dd0cd0fbaa1232bd5c42c9cd042a317ca04e0fc2d0881f6cf
Size

569KB
Sample

221001-zl735agcbr
MD5

47d29a97289704e931ca178ff524c806
SHA1

987e79053216acb7b225fe23c026a578ab69738b
SHA256

97d2e7808984018dd0cd0fbaa1232bd5c42c9cd042a317ca04e0fc2d0881f6cf
SHA512

994e19555be3e6db8c9db1ce4c802185740c6b1b3e5ea7a9e56229ade8c2e7c75edab0636862a939c92f966b1aad31b050aae8304ee2549c8a69acef97c41edc
SSDEEP

12288:QLSLyjBftSM5D2gdvfSS2GIIyJ8b/hhL9n7FEH:9LyjBfIA70GQ8b/DL9n6H

Score

10^/10

Malware Config

Targets

- Target
  
  97d2e7808984018dd0cd0fbaa1232bd5c42c9cd042a317ca04e0fc2d0881f6cf
- Size
  
  569KB
- MD5
  
  47d29a97289704e931ca178ff524c806
- SHA1
  
  987e79053216acb7b225fe23c026a578ab69738b
- SHA256
  
  97d2e7808984018dd0cd0fbaa1232bd5c42c9cd042a317ca04e0fc2d0881f6cf
- SHA512
  
  994e19555be3e6db8c9db1ce4c802185740c6b1b3e5ea7a9e56229ade8c2e7c75edab0636862a939c92f966b1aad31b050aae8304ee2549c8a69acef97c41edc
- SSDEEP
  
  12288:QLSLyjBftSM5D2gdvfSS2GIIyJ8b/hhL9n7FEH:9LyjBfIA70GQ8b/DL9n6H
Score

10^/10

modiloader evasion persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Adds policy Run key to start application
  persistence
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2