modiloader | a6afd2916044b64e05172a07bb89ebc2e5ad32490b2713f2dc1333d4d72ae0bb | Triage

Submit
Reports

Overview

overview

Static

static

a6afd29160...bb.exe

windows7-x64

a6afd29160...bb.exe

windows10-2004-x64

Resubmissions

20/12/2022, 16:56

221220-vft7vsde4s 10

20/12/2022, 16:51

221220-vc629aad54 10

Sharing

General

Target

a6afd2916044b64e05172a07bb89ebc2e5ad32490b2713f2dc1333d4d72ae0bb
Size

1.3MB
Sample

221220-vft7vsde4s
MD5

cb249434c4fa6661fe3dcceb9bcf2710
SHA1

2490784b000299293d98cef422664d71c91e9193
SHA256

a6afd2916044b64e05172a07bb89ebc2e5ad32490b2713f2dc1333d4d72ae0bb
SHA512

5d571310cfff25e96542153a08b865573ee28431532b7b40b70501679528e6b1fd96b13c7ba2988a48b49ccc9d693734e24eb2d883f55a49d153dc09a755341c
SSDEEP

24576:g+M5NGTKA8EUY7REc5dhOFgV48hq83zKwsPIKQsjPO5g8e/Rm55Mad/DHN:g+M5QTn8EUYackFWhqQfsQUT+g8e/Rdo

Score

10^/10

modiloader persistence trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

a6afd2916044b64e05172a07bb89ebc2e5ad32490b2713f2dc1333d4d72ae0bb.exe

Resource

win7-20221111-en

modiloader persistence trojan upx

windows7-x64

14 signatures

60 seconds

Behavioral task

behavioral2

Sample

a6afd2916044b64e05172a07bb89ebc2e5ad32490b2713f2dc1333d4d72ae0bb.exe

Resource

win10v2004-20221111-en

modiloader persistence trojan upx

windows10-2004-x64

14 signatures

60 seconds

Malware Config

Targets

- Target
  
  a6afd2916044b64e05172a07bb89ebc2e5ad32490b2713f2dc1333d4d72ae0bb
- Size
  
  1.3MB
- MD5
  
  cb249434c4fa6661fe3dcceb9bcf2710
- SHA1
  
  2490784b000299293d98cef422664d71c91e9193
- SHA256
  
  a6afd2916044b64e05172a07bb89ebc2e5ad32490b2713f2dc1333d4d72ae0bb
- SHA512
  
  5d571310cfff25e96542153a08b865573ee28431532b7b40b70501679528e6b1fd96b13c7ba2988a48b49ccc9d693734e24eb2d883f55a49d153dc09a755341c
- SSDEEP
  
  24576:g+M5NGTKA8EUY7REc5dhOFgV48hq83zKwsPIKQsjPO5g8e/Rm55Mad/DHN:g+M5QTn8EUYackFWhqQfsQUT+g8e/Rdo
Score

10^/10

modiloader persistence trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modifies WinLogon for persistence
  persistence
- ModiLoader Second Stage
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderpersistencetrojanupx

behavioral2

modiloaderpersistencetrojanupx

© 2018-2025

Terms | Privacy