modiloader | 9c952ad366eb7f5b3362536ba59c5064e17c36d274bac898c448818746a077db | Triage

Submit
Reports

Overview

overview

Static

static

9c952ad366...db.exe

windows7-x64

9c952ad366...db.exe

windows10-2004-x64

Sharing

General

Target

9c952ad366eb7f5b3362536ba59c5064e17c36d274bac898c448818746a077db
Size

133KB
Sample

221204-mnzhjsbb29
MD5

e4c6d023eea18b3bb5ad6319a494767a
SHA1

64ae9d34cd1bf826fcec72c390d97c5e52379f62
SHA256

9c952ad366eb7f5b3362536ba59c5064e17c36d274bac898c448818746a077db
SHA512

6e5af7eba6b6bdd37f46d71fad69cb7c53fffe246a0616611a5c3ff407bd08bd0b5b96105319c6b20e049ee139db40c6873cd8ebb458d67ea52a13982e78315a
SSDEEP

3072:filTkDlkjxh+sNHafUaYKlA4T3Xgo+us0jVqMF2:kkpYHafURK24THcGxDF2

Score

10^/10

modiloader evasion persistence trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

9c952ad366eb7f5b3362536ba59c5064e17c36d274bac898c448818746a077db.exe

Resource

win7-20221111-en

modiloader evasion persistence trojan upx

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

9c952ad366eb7f5b3362536ba59c5064e17c36d274bac898c448818746a077db.exe

Resource

win10v2004-20221111-en

modiloader evasion trojan upx

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  9c952ad366eb7f5b3362536ba59c5064e17c36d274bac898c448818746a077db
- Size
  
  133KB
- MD5
  
  e4c6d023eea18b3bb5ad6319a494767a
- SHA1
  
  64ae9d34cd1bf826fcec72c390d97c5e52379f62
- SHA256
  
  9c952ad366eb7f5b3362536ba59c5064e17c36d274bac898c448818746a077db
- SHA512
  
  6e5af7eba6b6bdd37f46d71fad69cb7c53fffe246a0616611a5c3ff407bd08bd0b5b96105319c6b20e049ee139db40c6873cd8ebb458d67ea52a13982e78315a
- SSDEEP
  
  3072:filTkDlkjxh+sNHafUaYKlA4T3Xgo+us0jVqMF2:kkpYHafURK24THcGxDF2
Score

10^/10

modiloader evasion persistence trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- UAC bypass
  evasion trojan
- ModiLoader Second Stage
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderevasionpersistencetrojanupx

behavioral2

modiloaderevasiontrojanupx

© 2018-2025

Terms | Privacy