modiloader | ec6ca2461cb77d91e47c6fc3eb67937019480511c04d8263a566bda38b355a7f

General

Target

7ecf23f3ab2568c8dc95bd1ec0d3ad15_JaffaCakes118
Size

794KB
Sample

240528-3qzjbsad86
MD5

7ecf23f3ab2568c8dc95bd1ec0d3ad15
SHA1

d7f7c3480bdeefd66d2e163130fcc0ca53eb5c2a
SHA256

ec6ca2461cb77d91e47c6fc3eb67937019480511c04d8263a566bda38b355a7f
SHA512

276241e61683fa432d3e071291d8a625788593190eb86ed0692556d1616d885a4586d074378251581e59ed9db4c3b4f1e9d294d62d74d89bbe3c162ac52b8398
SSDEEP

12288:1QHlW7lerECtu4aLgbqu6khVc0qI7oe3gPxWNpUcocscxFZwr:1QQperrOUj6k7ZqC30VFMlwr

Score

10^/10

Malware Config

Targets

- Target
  
  7ecf23f3ab2568c8dc95bd1ec0d3ad15_JaffaCakes118
- Size
  
  794KB
- MD5
  
  7ecf23f3ab2568c8dc95bd1ec0d3ad15
- SHA1
  
  d7f7c3480bdeefd66d2e163130fcc0ca53eb5c2a
- SHA256
  
  ec6ca2461cb77d91e47c6fc3eb67937019480511c04d8263a566bda38b355a7f
- SHA512
  
  276241e61683fa432d3e071291d8a625788593190eb86ed0692556d1616d885a4586d074378251581e59ed9db4c3b4f1e9d294d62d74d89bbe3c162ac52b8398
- SSDEEP
  
  12288:1QHlW7lerECtu4aLgbqu6khVc0qI7oe3gPxWNpUcocscxFZwr:1QQperrOUj6k7ZqC30VFMlwr
Score

10^/10

modiloader evasion persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2