modiloader | e1d89e3b650d099b7fecb4081e702a12dc4ec4f0036ba8a943bbf7e8ce74e044

General

Target

e1d89e3b650d099b7fecb4081e702a12dc4ec4f0036ba8a943bbf7e8ce74e044
Size

529KB
Sample

221003-awmgqsafal
MD5

74204399d2d8a25be76448626dd61299
SHA1

b2e0a1ea34da709e2b35bdc9b64a9662391192e3
SHA256

e1d89e3b650d099b7fecb4081e702a12dc4ec4f0036ba8a943bbf7e8ce74e044
SHA512

f41d213419445a354a574bfc86900ff5724cc5cbabf35fe65f5e15b73136101d5f866e2e8f5600a2f8bf62c2da819773ddb7d0b4cbd00be7e237ccdc00b98cb9
SSDEEP

12288:Bnu7/h3DNox+UtgjvXE5kmMy4lKx3x4GaGHjssYxHax:Ovoxrt4okzyDB/xjVYHax

Score

10^/10

Malware Config

Targets

- Target
  
  e1d89e3b650d099b7fecb4081e702a12dc4ec4f0036ba8a943bbf7e8ce74e044
- Size
  
  529KB
- MD5
  
  74204399d2d8a25be76448626dd61299
- SHA1
  
  b2e0a1ea34da709e2b35bdc9b64a9662391192e3
- SHA256
  
  e1d89e3b650d099b7fecb4081e702a12dc4ec4f0036ba8a943bbf7e8ce74e044
- SHA512
  
  f41d213419445a354a574bfc86900ff5724cc5cbabf35fe65f5e15b73136101d5f866e2e8f5600a2f8bf62c2da819773ddb7d0b4cbd00be7e237ccdc00b98cb9
- SSDEEP
  
  12288:Bnu7/h3DNox+UtgjvXE5kmMy4lKx3x4GaGHjssYxHax:Ovoxrt4okzyDB/xjVYHax
Score

10^/10

modiloader evasion persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Adds policy Run key to start application
  persistence
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2