modiloader | a160c05756d81a76a8298b90160999711caa853d5d17771c6bef0d52c38910ff

General

Target

24694fdfdf16084f4e39a683455ddac0_JaffaCakes118
Size

420KB
Sample

240508-mgejssfh2v
MD5

24694fdfdf16084f4e39a683455ddac0
SHA1

a23dce4b948395f8d448006adc3ab71a9dd6abb5
SHA256

a160c05756d81a76a8298b90160999711caa853d5d17771c6bef0d52c38910ff
SHA512

c25983e652d55c9160e6de86e9b3b3736f8fc175d800da5401ec7e51dbd243f4af1d943ae879a9525008323ea1b1310a2cf08e3e690952e2158a34b5086d9db1
SSDEEP

6144:Na/SLBjqbdiT+3mHFfutZTP0P3gXkHclSTu8yfYsbHmze84C3SU8rp0xe:QSL8bugT0PwEhiGK8B3Op0g

Score

10^/10

Malware Config

Targets

- Target
  
  24694fdfdf16084f4e39a683455ddac0_JaffaCakes118
- Size
  
  420KB
- MD5
  
  24694fdfdf16084f4e39a683455ddac0
- SHA1
  
  a23dce4b948395f8d448006adc3ab71a9dd6abb5
- SHA256
  
  a160c05756d81a76a8298b90160999711caa853d5d17771c6bef0d52c38910ff
- SHA512
  
  c25983e652d55c9160e6de86e9b3b3736f8fc175d800da5401ec7e51dbd243f4af1d943ae879a9525008323ea1b1310a2cf08e3e690952e2158a34b5086d9db1
- SSDEEP
  
  6144:Na/SLBjqbdiT+3mHFfutZTP0P3gXkHclSTu8yfYsbHmze84C3SU8rp0xe:QSL8bugT0PwEhiGK8B3Op0g
Score

10^/10

modiloader evasion persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2