modiloader | 8c777c0ffb0097d517ed08dee3c306d7fddc7687bcb0349d5eed0a6b5c82f93a | Triage

Sharing

General

Target

922af74d1c297ab5078bef3cf8c7cbc6_JaffaCakes118
Size

918KB
Sample

240603-r7mejsbc49
MD5

922af74d1c297ab5078bef3cf8c7cbc6
SHA1

5f9b595f5776bd675b88cad0f797cf01950055e3
SHA256

8c777c0ffb0097d517ed08dee3c306d7fddc7687bcb0349d5eed0a6b5c82f93a
SHA512

d37d82c1cd4e77c43b51ecb283773d82c6aaae7c596242f9372fa834f912c8f5f392f549245ac4f028cf8a7aa588b642900252e3270456b27438ce4b827baf82
SSDEEP

24576:ZK5hBlSW8pFD6iDIe62p5c2bSO9vWVa1o:ZK58W8f62Px8x

Score

10^/10

modiloader trojan

Malware Config

Extracted

Family

modiloader

C2

https://drive.google.com/u/0/uc?id=1BKqO_YkUPGwRKT_vzYTj7zx1s5xlp4SU&export=download

Targets

- Target
  
  922af74d1c297ab5078bef3cf8c7cbc6_JaffaCakes118
- Size
  
  918KB
- MD5
  
  922af74d1c297ab5078bef3cf8c7cbc6
- SHA1
  
  5f9b595f5776bd675b88cad0f797cf01950055e3
- SHA256
  
  8c777c0ffb0097d517ed08dee3c306d7fddc7687bcb0349d5eed0a6b5c82f93a
- SHA512
  
  d37d82c1cd4e77c43b51ecb283773d82c6aaae7c596242f9372fa834f912c8f5f392f549245ac4f028cf8a7aa588b642900252e3270456b27438ce4b827baf82
- SSDEEP
  
  24576:ZK5hBlSW8pFD6iDIe62p5c2bSO9vWVa1o:ZK58W8f62Px8x
Score

10^/10

modiloader trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader First Stage
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

modiloadertrojan

behavioral2

modiloadertrojan