modiloader | 4b776ed345b133863bcd954b24dc802409b64a17b41c497dc19a1a929e3b5d62 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

4b776ed345...62.exe

windows7-x64

4b776ed345...62.exe

windows10-2004-x64

Sharing

General

Target

4b776ed345b133863bcd954b24dc802409b64a17b41c497dc19a1a929e3b5d62
Size

186KB
Sample

221019-2x2rlacbbm
MD5

92329533810a2f732fb4147ca102c755
SHA1

4c252cd6305b805320482a5721036e52bf2f6953
SHA256

4b776ed345b133863bcd954b24dc802409b64a17b41c497dc19a1a929e3b5d62
SHA512

5879032cbf2cf9bc7464e445385999dcffd14929b9ec6e742bf3613bd7d1fd22f07e5ca5b9ddbffe34b0d7ce1b1b35a068b6cc5e1657fd6e72513d2b8a4c8cf1
SSDEEP

3072:VbR22QGWY6gBsCnn7okiIFbq49dcgxwU9SJlMxdSjXutbljlkZeQcvr:hR2vGWY6gBsCn7NVUP0wc4lwdUXSFlYK

Score

10^/10

modiloader persistence trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

4b776ed345b133863bcd954b24dc802409b64a17b41c497dc19a1a929e3b5d62.exe

Resource

win7-20220901-en

modiloader persistence trojan upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

4b776ed345b133863bcd954b24dc802409b64a17b41c497dc19a1a929e3b5d62.exe

Resource

win10v2004-20220812-en

modiloader persistence trojan upx

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  4b776ed345b133863bcd954b24dc802409b64a17b41c497dc19a1a929e3b5d62
- Size
  
  186KB
- MD5
  
  92329533810a2f732fb4147ca102c755
- SHA1
  
  4c252cd6305b805320482a5721036e52bf2f6953
- SHA256
  
  4b776ed345b133863bcd954b24dc802409b64a17b41c497dc19a1a929e3b5d62
- SHA512
  
  5879032cbf2cf9bc7464e445385999dcffd14929b9ec6e742bf3613bd7d1fd22f07e5ca5b9ddbffe34b0d7ce1b1b35a068b6cc5e1657fd6e72513d2b8a4c8cf1
- SSDEEP
  
  3072:VbR22QGWY6gBsCnn7okiIFbq49dcgxwU9SJlMxdSjXutbljlkZeQcvr:hR2vGWY6gBsCn7NVUP0wc4lwdUXSFlYK
Score

10^/10

modiloader persistence trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- Modifies Installed Components in the registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderpersistencetrojanupx

behavioral2

modiloaderpersistencetrojanupx

© 2018-2025

Terms | Privacy