modiloader | 16c6b911e5848d81142b4d0943286daf802edea4029eae5656cf179305605328

General

Target
16c6b911e5848d81142b4d0943286daf802edea4029eae5656cf179305605328
Size 807KB
Sample221107-ynbl9sfbb7
SHA256 16c6b911e5848d81142b4d0943286daf802edea4029eae5656cf179305605328
MD5 04f92939f6f7327aacab13c8f7852313
SHA1 8956901d27b85c094ed7324c66ddd4bb08e5a844
SHA512 9b68d05ed36e69918b8fbd3e184b2102ded543caff8a883a43fbb6ee057a0d8342dff77d1c08a1a56be4c5e6d7f963596e0c1e0edd024ae0b1eda97593306950
SSDEEP 24576:FYkjlRgR+tmbs1t9qgYohxfloUZhjaoJKwbgy:FYsRhtmMKcoUvPJKwbgy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  16c6b911e5848d81142b4d0943286daf802edea4029eae5656cf179305605328
- Size 807KB
- SHA256 16c6b911e5848d81142b4d0943286daf802edea4029eae5656cf179305605328
- MD5 04f92939f6f7327aacab13c8f7852313
- SHA1 8956901d27b85c094ed7324c66ddd4bb08e5a844
- SHA512 9b68d05ed36e69918b8fbd3e184b2102ded543caff8a883a43fbb6ee057a0d8342dff77d1c08a1a56be4c5e6d7f963596e0c1e0edd024ae0b1eda97593306950
- SSDEEP 24576:FYkjlRgR+tmbs1t9qgYohxfloUZhjaoJKwbgy:FYsRhtmMKcoUvPJKwbgy
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

modiloader pony discovery evasion persistence rat spyware stealer trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modifies security service
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- ModiLoader Second Stage
- Disables taskbar notifications via registry modification
  evasion
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2