modiloader | 452c32b0ddeb03eea7653f2e1d283a426f5f2858513cf6ad9829cf657853b617

General

Target

452c32b0ddeb03eea7653f2e1d283a426f5f2858513cf6ad9829cf657853b617
Size

373KB
Sample

221127-pvhvgsgg75
MD5

f21cffba819669076a44740ad09cd06e
SHA1

abea637c853799314c6c0409f39e6c0846d340c5
SHA256

452c32b0ddeb03eea7653f2e1d283a426f5f2858513cf6ad9829cf657853b617
SHA512

3d9ab9acca47242667cb97384e4310730847e30c8b62391ebea01982609f7cc815a49ebfc4de8bd1c7766fc81adc03b425c55081430fa882c6d2d586981e036c
SSDEEP

6144:NnQmaBV1cf8tZnnxH8CEEvB35K4rULAYoFwIDvFxVfPZAfpdQqbiMFaf3lJx6vNm:+HV1caZn7VN5Kl89HLbVfPiBdQ/MFafL

Score

10^/10

Malware Config

Targets

- Target
  
  452c32b0ddeb03eea7653f2e1d283a426f5f2858513cf6ad9829cf657853b617
- Size
  
  373KB
- MD5
  
  f21cffba819669076a44740ad09cd06e
- SHA1
  
  abea637c853799314c6c0409f39e6c0846d340c5
- SHA256
  
  452c32b0ddeb03eea7653f2e1d283a426f5f2858513cf6ad9829cf657853b617
- SHA512
  
  3d9ab9acca47242667cb97384e4310730847e30c8b62391ebea01982609f7cc815a49ebfc4de8bd1c7766fc81adc03b425c55081430fa882c6d2d586981e036c
- SSDEEP
  
  6144:NnQmaBV1cf8tZnnxH8CEEvB35K4rULAYoFwIDvFxVfPZAfpdQqbiMFaf3lJx6vNm:+HV1caZn7VN5Kl89HLbVfPiBdQ/MFafL
Score

10^/10

modiloader evasion persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- ModiLoader Second Stage
- Adds policy Run key to start application
  persistence
- Disables use of System Restore points
  evasion
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2