modiloader | 5a6a26bfc765765018d45c2d1ffe71a63196d3a44f3a5c14d5959a5c863b5565 | Triage

Submit
Reports

Overview

overview

Static

static

5a6a26bfc7...65.exe

windows7-x64

5a6a26bfc7...65.exe

windows10-2004-x64

Sharing

General

Target

5a6a26bfc765765018d45c2d1ffe71a63196d3a44f3a5c14d5959a5c863b5565
Size

306KB
Sample

221002-yz29csaecp
MD5

66a59c0e9cfa2e844f9790c12c261765
SHA1

745c284a2e76038cbc23373b28fb032a7ebf803a
SHA256

5a6a26bfc765765018d45c2d1ffe71a63196d3a44f3a5c14d5959a5c863b5565
SHA512

af7af686a65d7c2a7e5e1de1a7118da4a1fbf73d1677b0b37bee1886093bb7d029fd323ab0a4b313f03877721462feaf07ee5bf68fae2ce7cee9ccca936cd9fc
SSDEEP

6144:SyH7xOc6H5c6HcT66vlmO253kpcCJJvHL2CeiorXdwTBgWx41eA+xwDB9IP3WubJ:SajbJJvHL6RwTyCs9+xOB9bubsw66

Score

10^/10

modiloader evasion persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

5a6a26bfc765765018d45c2d1ffe71a63196d3a44f3a5c14d5959a5c863b5565.exe

Resource

win7-20220812-en

modiloader evasion persistence trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

5a6a26bfc765765018d45c2d1ffe71a63196d3a44f3a5c14d5959a5c863b5565.exe

Resource

win10v2004-20220812-en

modiloader evasion persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  5a6a26bfc765765018d45c2d1ffe71a63196d3a44f3a5c14d5959a5c863b5565
- Size
  
  306KB
- MD5
  
  66a59c0e9cfa2e844f9790c12c261765
- SHA1
  
  745c284a2e76038cbc23373b28fb032a7ebf803a
- SHA256
  
  5a6a26bfc765765018d45c2d1ffe71a63196d3a44f3a5c14d5959a5c863b5565
- SHA512
  
  af7af686a65d7c2a7e5e1de1a7118da4a1fbf73d1677b0b37bee1886093bb7d029fd323ab0a4b313f03877721462feaf07ee5bf68fae2ce7cee9ccca936cd9fc
- SSDEEP
  
  6144:SyH7xOc6H5c6HcT66vlmO253kpcCJJvHL2CeiorXdwTBgWx41eA+xwDB9IP3WubJ:SajbJJvHL6RwTyCs9+xOB9bubsw66
Score

10^/10

modiloader evasion persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- UAC bypass
  evasion trojan
- ModiLoader Second Stage
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderevasionpersistencetrojan

behavioral2

modiloaderevasionpersistencetrojan

© 2018-2025

Terms | Privacy