modiloader | 49f5377ac30c7eea66a087626d1b21d953e1382aa258a812a9beb6972132c1b4

General

Target

49f5377ac30c7eea66a087626d1b21d953e1382aa258a812a9beb6972132c1b4
Size

807KB
Sample

221107-ykn37aehg8
MD5

0c2d3550d7dd69ca00bf457486d17745
SHA1

aa2a371a5356646b7e830dbed170d7aed1b326a4
SHA256

49f5377ac30c7eea66a087626d1b21d953e1382aa258a812a9beb6972132c1b4
SHA512

e525882afefcac39b7c429c7874c2e6d70fe55c806837eec6326b3a22ddd311271ee0e16475cf36e0a45db0a1df7ac77fcbaf139983c903a96538ddb4022ea1c
SSDEEP

24576:FYkjlZgR+tmbs1t9qgYohxfloUZhjaoJKwbgy:FYsZhtmMKcoUvPJKwbgy

Score

10^/10

Malware Config

Targets

- Target
  
  49f5377ac30c7eea66a087626d1b21d953e1382aa258a812a9beb6972132c1b4
- Size
  
  807KB
- MD5
  
  0c2d3550d7dd69ca00bf457486d17745
- SHA1
  
  aa2a371a5356646b7e830dbed170d7aed1b326a4
- SHA256
  
  49f5377ac30c7eea66a087626d1b21d953e1382aa258a812a9beb6972132c1b4
- SHA512
  
  e525882afefcac39b7c429c7874c2e6d70fe55c806837eec6326b3a22ddd311271ee0e16475cf36e0a45db0a1df7ac77fcbaf139983c903a96538ddb4022ea1c
- SSDEEP
  
  24576:FYkjlZgR+tmbs1t9qgYohxfloUZhjaoJKwbgy:FYsZhtmMKcoUvPJKwbgy
Score

10^/10

modiloader pony discovery evasion persistence rat spyware stealer trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modifies security service
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- ModiLoader Second Stage
- Disables taskbar notifications via registry modification
  evasion
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2