modiloader | 0a87aba4a7fc0fa336891cfbc6618106b3cd432dcb895bf5c34e3a5909baaf55

General

Target

74f56722bc9a37b63e8afa04387a3175_JaffaCakes118
Size

358KB
Sample

240526-kx6bcadg93
MD5

74f56722bc9a37b63e8afa04387a3175
SHA1

8a10b5e57083fb40d224c58fc792d37c951a5028
SHA256

0a87aba4a7fc0fa336891cfbc6618106b3cd432dcb895bf5c34e3a5909baaf55
SHA512

e2b20a98e17ad30d9d345db3a1f1820371be98f74c0dc36d36cf6483e678977d82a49cbbdee98bc9936dcaee511eed8c132922e9abb6ce0b2562a054fec59392
SSDEEP

6144:nBxx+cxjNh6dvHNTFqJFcYxTw98k8/PmTlfYnJ8ms:FEH7qJndGTl3

Score

10^/10

Malware Config

Targets

- Target
  
  74f56722bc9a37b63e8afa04387a3175_JaffaCakes118
- Size
  
  358KB
- MD5
  
  74f56722bc9a37b63e8afa04387a3175
- SHA1
  
  8a10b5e57083fb40d224c58fc792d37c951a5028
- SHA256
  
  0a87aba4a7fc0fa336891cfbc6618106b3cd432dcb895bf5c34e3a5909baaf55
- SHA512
  
  e2b20a98e17ad30d9d345db3a1f1820371be98f74c0dc36d36cf6483e678977d82a49cbbdee98bc9936dcaee511eed8c132922e9abb6ce0b2562a054fec59392
- SSDEEP
  
  6144:nBxx+cxjNh6dvHNTFqJFcYxTw98k8/PmTlfYnJ8ms:FEH7qJndGTl3
Score

10^/10

modiloader evasion persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2