modiloader | 6b412a25170b02b37314ed69305573b0793c9191a69ccb274bddec4dd308d22d

General

Target

702c8c9b1c38fa1a85b1252fadcb6c56_JaffaCakes118
Size

336KB
Sample

240524-3n1cvafb9w
MD5

702c8c9b1c38fa1a85b1252fadcb6c56
SHA1

c35cc8add5d270e8c79d02d28e1276dde12fc52b
SHA256

6b412a25170b02b37314ed69305573b0793c9191a69ccb274bddec4dd308d22d
SHA512

e613884e29a81c572a0da336c738a8db5c07dc01ff5bdc6ff1538c7fecd1f5011e405dd0f21fbad9ecad6dffacc1fe6cd33242b583a448dcd190225a9ef13537
SSDEEP

6144:WZ6enhqaBpOx1VfOtzqqwPyin7tBO4RSxjQE/OeyB3V9DuEK2e2:ctnhqaBgOoHn7tBOQc92xpV9DuL12

Score

10^/10

Malware Config

Targets

- Target
  
  702c8c9b1c38fa1a85b1252fadcb6c56_JaffaCakes118
- Size
  
  336KB
- MD5
  
  702c8c9b1c38fa1a85b1252fadcb6c56
- SHA1
  
  c35cc8add5d270e8c79d02d28e1276dde12fc52b
- SHA256
  
  6b412a25170b02b37314ed69305573b0793c9191a69ccb274bddec4dd308d22d
- SHA512
  
  e613884e29a81c572a0da336c738a8db5c07dc01ff5bdc6ff1538c7fecd1f5011e405dd0f21fbad9ecad6dffacc1fe6cd33242b583a448dcd190225a9ef13537
- SSDEEP
  
  6144:WZ6enhqaBpOx1VfOtzqqwPyin7tBO4RSxjQE/OeyB3V9DuEK2e2:ctnhqaBgOoHn7tBOQc92xpV9DuL12
Score

10^/10

modiloader evasion persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Targets

ModiLoader, DBatLoader

Process spawned unexpected child process

Checks for common network interception software

Looks for VirtualBox Guest Additions in registry

Looks for VirtualBox drivers on disk

ModiLoader Second Stage

Looks for VMWare Tools registry key

Checks BIOS information in registry

Checks computer location settings

Deletes itself

Adds Run key to start application

Maps connected drives based on registry

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2