modiloader | a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24

General

Target

a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe
Size

1.4MB
Sample

240524-bznpmsge3s
MD5

0b7e50b40135c3919e58a39b9a224353
SHA1

3e2bfa0bec42f913d52b4df5c58dac2d10a80922
SHA256

a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24
SHA512

3aa4e32dce04bcc5d36fecbe722064cee6c4211806414438d34f1a9fb29862dbe022b2890efb64f490a636b5fb38dc17a65192ae29a4830633bfd69ed182708a
SSDEEP

24576:yn25nPkW3amy8sQxeWcktTjbJ49auDyEEEEEEEEEEEEEEEEEEEETKKKKKKKKKKKr:yn2kGy7wTjbI/DyEEEEEEEEEEEEEEEEm

Score

10^/10

Malware Config

Targets

- Target
  
  a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe
- Size
  
  1.4MB
- MD5
  
  0b7e50b40135c3919e58a39b9a224353
- SHA1
  
  3e2bfa0bec42f913d52b4df5c58dac2d10a80922
- SHA256
  
  a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24
- SHA512
  
  3aa4e32dce04bcc5d36fecbe722064cee6c4211806414438d34f1a9fb29862dbe022b2890efb64f490a636b5fb38dc17a65192ae29a4830633bfd69ed182708a
- SSDEEP
  
  24576:yn25nPkW3amy8sQxeWcktTjbJ49auDyEEEEEEEEEEEEEEEEEEEETKKKKKKKKKKKr:yn2kGy7wTjbI/DyEEEEEEEEEEEEEEEEm
Score

10^/10

modiloader persistence spyware stealer trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Detect packed .NET executables. Mostly AgentTeslaV4.
- ModiLoader Second Stage
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Targets

ModiLoader, DBatLoader

Detect packed .NET executables. Mostly AgentTeslaV4.

ModiLoader Second Stage

Executes dropped EXE

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2