modiloader | 38f87cd2972d0d6bdfdcee1989ebf0aa262c41247feab6af4c00b8f9ee2dfa6c | Triage

Submit
Reports

Overview

overview

Static

static

05a721f1a2...ec.exe

windows7-x64

1

05a721f1a2...ec.exe

windows10-2004-x64

Sharing

General

Target

05a721f1a2c81ca505b7ac1c968b89ec
Size

96KB
Sample

231229-2e9dqaebhl
MD5

05a721f1a2c81ca505b7ac1c968b89ec
SHA1

50ac99203449a968ec880fb6d296805189e49c7f
SHA256

38f87cd2972d0d6bdfdcee1989ebf0aa262c41247feab6af4c00b8f9ee2dfa6c
SHA512

1fa151ddc5f195e15b33670ca398055e5e4496f80c191aa55f7cd90e4e3e4bcffea983b01f3c4696bdbbfc11add52c2aa619b3a30ea5f9a76ab05c4d143b2529
SSDEEP

1536:sTqaxQU2FIrx1LCPYhOaXrtwLOeKNsHpR2GNcI2Eekn+laEs64H0/KR0NBAY6GP:2xr2lPYUaXrtwLOhGCI3oYEsP30NH6i

Score

10^/10

modiloader adware evasion stealer trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

05a721f1a2c81ca505b7ac1c968b89ec.exe

Resource

win7-20231215-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

05a721f1a2c81ca505b7ac1c968b89ec.exe

Resource

win10v2004-20231215-en

modiloader adware evasion stealer trojan

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  05a721f1a2c81ca505b7ac1c968b89ec
- Size
  
  96KB
- MD5
  
  05a721f1a2c81ca505b7ac1c968b89ec
- SHA1
  
  50ac99203449a968ec880fb6d296805189e49c7f
- SHA256
  
  38f87cd2972d0d6bdfdcee1989ebf0aa262c41247feab6af4c00b8f9ee2dfa6c
- SHA512
  
  1fa151ddc5f195e15b33670ca398055e5e4496f80c191aa55f7cd90e4e3e4bcffea983b01f3c4696bdbbfc11add52c2aa619b3a30ea5f9a76ab05c4d143b2529
- SSDEEP
  
  1536:sTqaxQU2FIrx1LCPYhOaXrtwLOeKNsHpR2GNcI2Eekn+laEs64H0/KR0NBAY6GP:2xr2lPYUaXrtwLOhGCI3oYEsP30NH6i
Score

10^/10

modiloader adware evasion stealer trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modifies firewall policy service
  evasion
- ModiLoader Second Stage
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

modiloaderadwareevasionstealertrojan

© 2018-2024

Terms | Privacy