modiloader | 43bb5ce39aa18f8d17eb1243cbf327a16b2c0b05c94dc7e2044b773d6e8193ee | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

43bb5ce39a...ee.exe

windows7-x64

43bb5ce39a...ee.exe

windows10-2004-x64

Sharing

General

Target

43bb5ce39aa18f8d17eb1243cbf327a16b2c0b05c94dc7e2044b773d6e8193ee.sample
Size

275KB
Sample

230318-ztbpwsdg33
MD5

82808f7ff9cf6b09815efb737e80aaa7
SHA1

053d4c5f5a937c746b4768aa74062fbd825860df
SHA256

43bb5ce39aa18f8d17eb1243cbf327a16b2c0b05c94dc7e2044b773d6e8193ee
SHA512

c05c047ad0a593b3c946d156a13cb048fb7e10ff94fbc60ce0a2f3a9478342276597d30ad13e4802751bfd319fd8c47d2dc3029b257c2e2cc873b74f4afbc12b
SSDEEP

6144:KG377xS2Vp2CeiorXhwTBOx53UpcCJJvH:Zr7xS2Vp6FwTFbJJvH

Score

10^/10

modiloader evasion persistence trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

43bb5ce39aa18f8d17eb1243cbf327a16b2c0b05c94dc7e2044b773d6e8193ee.exe

Resource

win7-20230220-en

modiloader evasion persistence trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

43bb5ce39aa18f8d17eb1243cbf327a16b2c0b05c94dc7e2044b773d6e8193ee.exe

Resource

win10v2004-20230220-en

modiloader evasion persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  43bb5ce39aa18f8d17eb1243cbf327a16b2c0b05c94dc7e2044b773d6e8193ee.sample
- Size
  
  275KB
- MD5
  
  82808f7ff9cf6b09815efb737e80aaa7
- SHA1
  
  053d4c5f5a937c746b4768aa74062fbd825860df
- SHA256
  
  43bb5ce39aa18f8d17eb1243cbf327a16b2c0b05c94dc7e2044b773d6e8193ee
- SHA512
  
  c05c047ad0a593b3c946d156a13cb048fb7e10ff94fbc60ce0a2f3a9478342276597d30ad13e4802751bfd319fd8c47d2dc3029b257c2e2cc873b74f4afbc12b
- SSDEEP
  
  6144:KG377xS2Vp2CeiorXhwTBOx53UpcCJJvH:Zr7xS2Vp6FwTFbJJvH
Score

10^/10

modiloader evasion persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- UAC bypass
  evasion trojan
- ModiLoader Second Stage
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderevasionpersistencetrojan

behavioral2

modiloaderevasionpersistencetrojan

© 2018-2025

Terms | Privacy