modiloader | ad2f2e352b3738b96d50b96d965b41e259d8f02f208bbb7c4fa3d511c3b66320

General

Target

ad2f2e352b3738b96d50b96d965b41e259d8f02f208bbb7c4fa3d511c3b66320
Size

330KB
Sample

221128-ff644aff68
MD5

9423046268e7c8812b1cbb1f4f4ba014
SHA1

dcd84d81b8dce030e300c8b853ca69ea3aa40dae
SHA256

ad2f2e352b3738b96d50b96d965b41e259d8f02f208bbb7c4fa3d511c3b66320
SHA512

693222818ad558409353de6c1bd8f6bf91d7bbcf46c4e681cbc331ca177991bb8648dc969d31e2dd845499b401d7e435cffb3ec06a1612164e41fab2b96270d0
SSDEEP

6144:qkG3Sd5/QqsXzSIN8GQH29HcohpgaqZK9zHGQ7DXQccckM:ECnsOCZhraQ7D4M

Score

10^/10

Malware Config

Targets

- Target
  
  ad2f2e352b3738b96d50b96d965b41e259d8f02f208bbb7c4fa3d511c3b66320
- Size
  
  330KB
- MD5
  
  9423046268e7c8812b1cbb1f4f4ba014
- SHA1
  
  dcd84d81b8dce030e300c8b853ca69ea3aa40dae
- SHA256
  
  ad2f2e352b3738b96d50b96d965b41e259d8f02f208bbb7c4fa3d511c3b66320
- SHA512
  
  693222818ad558409353de6c1bd8f6bf91d7bbcf46c4e681cbc331ca177991bb8648dc969d31e2dd845499b401d7e435cffb3ec06a1612164e41fab2b96270d0
- SSDEEP
  
  6144:qkG3Sd5/QqsXzSIN8GQH29HcohpgaqZK9zHGQ7DXQccckM:ECnsOCZhraQ7D4M
Score

10^/10

modiloader evasion persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Adds policy Run key to start application
  persistence
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2