modiloader | 1cf92e2ce41fd1ba467d1cb53b7b66023bf0bc37b27a4cefcbe14019f45f6167

General

Target

724bb3a4a3b577685a38a71cd8d870c8_JaffaCakes118
Size

356KB
Sample

240525-r1w1eaga5y
MD5

724bb3a4a3b577685a38a71cd8d870c8
SHA1

9126a1499cb6ff3f4cb785ffbec6a3b3d69b80b2
SHA256

1cf92e2ce41fd1ba467d1cb53b7b66023bf0bc37b27a4cefcbe14019f45f6167
SHA512

d90c5648a0341f84a255a0672b90a930f5ed627606427ef1dd1aa2b025dc015713fa28d57f4c6db3ab444c80674eb2610fb4c4cbc4361bde9e6c69544bb43dc7
SSDEEP

6144:smUdcds3QFSx8tWHTG7pYIGAKeBbCalBcDS00XxMOxz0hJGUKsvZVM5QiMtX:smlddw+MeBb5lBIPjOMJGOZV9l

Score

10^/10

Malware Config

Targets

- Target
  
  724bb3a4a3b577685a38a71cd8d870c8_JaffaCakes118
- Size
  
  356KB
- MD5
  
  724bb3a4a3b577685a38a71cd8d870c8
- SHA1
  
  9126a1499cb6ff3f4cb785ffbec6a3b3d69b80b2
- SHA256
  
  1cf92e2ce41fd1ba467d1cb53b7b66023bf0bc37b27a4cefcbe14019f45f6167
- SHA512
  
  d90c5648a0341f84a255a0672b90a930f5ed627606427ef1dd1aa2b025dc015713fa28d57f4c6db3ab444c80674eb2610fb4c4cbc4361bde9e6c69544bb43dc7
- SSDEEP
  
  6144:smUdcds3QFSx8tWHTG7pYIGAKeBbCalBcDS00XxMOxz0hJGUKsvZVM5QiMtX:smlddw+MeBb5lBIPjOMJGOZV9l
Score

10^/10

modiloader evasion persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2