modiloader | f664c20efaa2585fb95ad662bfffbff697000c2d9a53eafd19748c33e3f92654

General

Target

34e6b6968a891c13147fe2727ed03cfc_JaffaCakes118
Size

331KB
Sample

240511-q58pbsad9x
MD5

34e6b6968a891c13147fe2727ed03cfc
SHA1

0ed0abd57edbdd8b4881274fcdf6d04b5c587ff6
SHA256

f664c20efaa2585fb95ad662bfffbff697000c2d9a53eafd19748c33e3f92654
SHA512

99b7cafcb47dc4ac1468f407affce731da5f49bb94c2c91c2a5710c27e2467f4b5b8aa0429d6f7b827ddec4723b72d8b8eaecab423a018f25d5a7df40f08d248
SSDEEP

6144:nntq5dUxVddWJagnuu1OMHO9tGu/haFFd47SFLEHkIutqpdn:ntq5dUxVddLu1VLY0F6EIut+n

Score

10^/10

Malware Config

Targets

- Target
  
  34e6b6968a891c13147fe2727ed03cfc_JaffaCakes118
- Size
  
  331KB
- MD5
  
  34e6b6968a891c13147fe2727ed03cfc
- SHA1
  
  0ed0abd57edbdd8b4881274fcdf6d04b5c587ff6
- SHA256
  
  f664c20efaa2585fb95ad662bfffbff697000c2d9a53eafd19748c33e3f92654
- SHA512
  
  99b7cafcb47dc4ac1468f407affce731da5f49bb94c2c91c2a5710c27e2467f4b5b8aa0429d6f7b827ddec4723b72d8b8eaecab423a018f25d5a7df40f08d248
- SSDEEP
  
  6144:nntq5dUxVddWJagnuu1OMHO9tGu/haFFd47SFLEHkIutqpdn:ntq5dUxVddLu1VLY0F6EIut+n
Score

10^/10

modiloader evasion persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2