modiloader | a51fa39c072efa56d756b22e7578d136fe35ea72b8c9fb3d38ed856fa37788f6 | Triage

Sharing

General

Target

a51fa39c072efa56d756b22e7578d136fe35ea72b8c9fb3d38ed856fa37788f6
Size

182KB
Sample

221107-gwmwtseagr
MD5

0c9a00fc87926ec659f410166fa7133d
SHA1

4b3ad9dc962c5def9b8704bd1f550fdc0c3d184f
SHA256

a51fa39c072efa56d756b22e7578d136fe35ea72b8c9fb3d38ed856fa37788f6
SHA512

0ba5facfbe3eb888ddc025a58965af0262b24bc08d0ca05f3cbef22fb8ca9aa67cb8439f79e3287ec056dbf45245cd4da2e99c919d30304c57b0bb82d12caea1
SSDEEP

3072:GrpaFSv/U6rw6DmSx2MzHnIyIH3uAGWcmnYyA6tBcwlprGhNBEHw:G1aFSXS6DmWIycDGWfYyvOiun

Score

10^/10

modiloader persistence trojan

Malware Config

Targets

- Target
  
  a51fa39c072efa56d756b22e7578d136fe35ea72b8c9fb3d38ed856fa37788f6
- Size
  
  182KB
- MD5
  
  0c9a00fc87926ec659f410166fa7133d
- SHA1
  
  4b3ad9dc962c5def9b8704bd1f550fdc0c3d184f
- SHA256
  
  a51fa39c072efa56d756b22e7578d136fe35ea72b8c9fb3d38ed856fa37788f6
- SHA512
  
  0ba5facfbe3eb888ddc025a58965af0262b24bc08d0ca05f3cbef22fb8ca9aa67cb8439f79e3287ec056dbf45245cd4da2e99c919d30304c57b0bb82d12caea1
- SSDEEP
  
  3072:GrpaFSv/U6rw6DmSx2MzHnIyIH3uAGWcmnYyA6tBcwlprGhNBEHw:G1aFSXS6DmWIycDGWfYyvOiun
Score

10^/10

modiloader persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- Sets DLL path for service in the registry
  persistence
- Deletes itself
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderpersistencetrojan

behavioral2