modiloader | 0562f7ec116c9229461ad3faeb580e19d2af7e36ffd099fafc0caaf469d1faa0

General

Target

0562f7ec116c9229461ad3faeb580e19d2af7e36ffd099fafc0caaf469d1faa0
Size

349KB
Sample

221127-gemjqsgg2z
MD5

b8252d4c5808663055ac6a739fa1840e
SHA1

73086cd2022a12b74c1f56c267cff3dfb3265fcc
SHA256

0562f7ec116c9229461ad3faeb580e19d2af7e36ffd099fafc0caaf469d1faa0
SHA512

e34405107822a7a3b0d59cb7cf1caab796ed89515fab062a21cda0c0af4a4b7267857d904631539737e013b76fc130b81fd6609c6eb5bf1aaef12a578f7c1587
SSDEEP

6144:1wFXM/uqYpIlsELyTIsiiagfbLiohpLELh9TrCkSCP+CBm3Yk2kjD4TK:IXKzsELyTMiF8LnTrNP+CwIkFD4u

Score

10^/10

Malware Config

Targets

- Target
  
  0562f7ec116c9229461ad3faeb580e19d2af7e36ffd099fafc0caaf469d1faa0
- Size
  
  349KB
- MD5
  
  b8252d4c5808663055ac6a739fa1840e
- SHA1
  
  73086cd2022a12b74c1f56c267cff3dfb3265fcc
- SHA256
  
  0562f7ec116c9229461ad3faeb580e19d2af7e36ffd099fafc0caaf469d1faa0
- SHA512
  
  e34405107822a7a3b0d59cb7cf1caab796ed89515fab062a21cda0c0af4a4b7267857d904631539737e013b76fc130b81fd6609c6eb5bf1aaef12a578f7c1587
- SSDEEP
  
  6144:1wFXM/uqYpIlsELyTIsiiagfbLiohpLELh9TrCkSCP+CBm3Yk2kjD4TK:IXKzsELyTMiF8LnTrNP+CwIkFD4u
Score

10^/10

modiloader evasion persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- ModiLoader Second Stage
- Adds policy Run key to start application
  persistence
- Disables use of System Restore points
  evasion
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2