modiloader | fd3a46030ed1eb77dec79eb654baedbe7392ea2dc6412ee3379cad72e4bcd0ff | Triage

Submit
Reports

Overview

overview

Static

static

fd3a46030e...ff.exe

windows7-x64

fd3a46030e...ff.exe

windows10-2004-x64

Sharing

General

Target

fd3a46030ed1eb77dec79eb654baedbe7392ea2dc6412ee3379cad72e4bcd0ff
Size

71KB
Sample

221205-gkj1ssfe2x
MD5

0fe83c4616cfb7801fccfc42dabe1621
SHA1

938fab043227ad2c66254d68edf1f5bf0804c85a
SHA256

fd3a46030ed1eb77dec79eb654baedbe7392ea2dc6412ee3379cad72e4bcd0ff
SHA512

cf28915483857aa232bf7323f44bb04aeecf77dd7b93a907d233ed1fabe22c29467a4f0987b41bff1bdc6b9e99d159dfa0ddd5ba51a3ff4d3e09e4e91c08d9a9
SSDEEP

1536:39qSmMABU5i7fG3U9HA4p2d1WF+De/y99RR9+HRO+e3syU:tqSmMAffG3iHA4pI7D6y/ARO+e3

Score

10^/10

modiloader persistence trojan upx

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

fd3a46030ed1eb77dec79eb654baedbe7392ea2dc6412ee3379cad72e4bcd0ff.exe

Resource

win7-20220901-en

modiloader persistence trojan upx

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

fd3a46030ed1eb77dec79eb654baedbe7392ea2dc6412ee3379cad72e4bcd0ff.exe

Resource

win10v2004-20220812-en

modiloader persistence trojan upx

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  fd3a46030ed1eb77dec79eb654baedbe7392ea2dc6412ee3379cad72e4bcd0ff
- Size
  
  71KB
- MD5
  
  0fe83c4616cfb7801fccfc42dabe1621
- SHA1
  
  938fab043227ad2c66254d68edf1f5bf0804c85a
- SHA256
  
  fd3a46030ed1eb77dec79eb654baedbe7392ea2dc6412ee3379cad72e4bcd0ff
- SHA512
  
  cf28915483857aa232bf7323f44bb04aeecf77dd7b93a907d233ed1fabe22c29467a4f0987b41bff1bdc6b9e99d159dfa0ddd5ba51a3ff4d3e09e4e91c08d9a9
- SSDEEP
  
  1536:39qSmMABU5i7fG3U9HA4p2d1WF+De/y99RR9+HRO+e3syU:tqSmMAffG3iHA4pI7D6y/ARO+e3
Score

10^/10

modiloader persistence trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modifies WinLogon for persistence
  persistence
- ModiLoader Second Stage
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderpersistencetrojanupx

behavioral2

modiloaderpersistencetrojanupx

© 2018-2024

Terms | Privacy