modiloader | b2939aee96b950ca152f10d4791107be9f71f17f4d42e55183d259f8f7b6a6e7

General

Target

b2939aee96b950ca152f10d4791107be9f71f17f4d42e55183d259f8f7b6a6e7
Size

6.3MB
Sample

221126-3r7w4ahb4z
MD5

7f66b63ae030d04a43178df57bb78b1a
SHA1

8605715d8de48241315ec8fcfb91a8380f6776c1
SHA256

b2939aee96b950ca152f10d4791107be9f71f17f4d42e55183d259f8f7b6a6e7
SHA512

4a0590a23c10dd257692e1f4497912935556d4e152fe09ecd1eb2531fba0ee80a079c589068315623ff660c8e5c99871d68a4d48fecfc7ed579081c5e77def46
SSDEEP

98304:A1RaZKOTNyQE17hjs+USipFnLSXF9v8CqLoiLwst/IxZsQU3wDkAaXnmkhD:4aZXTLcVs+upF4Lv8CqSstUKQU1lL5

Score

10^/10

Malware Config

Extracted

Family

xtremerat

C2

remotedesktop11.no-ip.info

Targets

- Target
  
  b2939aee96b950ca152f10d4791107be9f71f17f4d42e55183d259f8f7b6a6e7
- Size
  
  6.3MB
- MD5
  
  7f66b63ae030d04a43178df57bb78b1a
- SHA1
  
  8605715d8de48241315ec8fcfb91a8380f6776c1
- SHA256
  
  b2939aee96b950ca152f10d4791107be9f71f17f4d42e55183d259f8f7b6a6e7
- SHA512
  
  4a0590a23c10dd257692e1f4497912935556d4e152fe09ecd1eb2531fba0ee80a079c589068315623ff660c8e5c99871d68a4d48fecfc7ed579081c5e77def46
- SSDEEP
  
  98304:A1RaZKOTNyQE17hjs+USipFnLSXF9v8CqLoiLwst/IxZsQU3wDkAaXnmkhD:4aZXTLcVs+upF4Lv8CqSstUKQU1lL5
Score

10^/10

modiloader persistence trojan upx xtremerat rat spyware
- Detect XtremeRAT payload
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- ModiLoader Second Stage
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect XtremeRAT payload

ModiLoader, DBatLoader

XtremeRAT

ModiLoader Second Stage

Executes dropped EXE

UPX packed file

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2