modiloader | d548e01ba094e4957b369e4bb0bc96c02559b2973879258237417e13bfeacae2 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

102fd70e1c...18.exe

windows7-x64

102fd70e1c...18.exe

windows10-2004-x64

Sharing

General

Target

102fd70e1cc78fa1a648d14f9d425087_JaffaCakes118
Size

157KB
Sample

240626-bejvysvdjf
MD5

102fd70e1cc78fa1a648d14f9d425087
SHA1

176473670c63643a21d796a719674a7277bcd50c
SHA256

d548e01ba094e4957b369e4bb0bc96c02559b2973879258237417e13bfeacae2
SHA512

5d7832efa7b834ef3fd1751345d71f3e7557a6f736f71743bf8a40efd884c130966452e2597308e71153270c66244b7bf97b56318b0cef89fa90bb01231791f6
SSDEEP

3072:MXAScc0i+zmLUAcO8RE5PPDlUFCyCXGAac7ZxWGC2LWp9x8pNr15bzlngqDGGWq/:M1PcaV0AHDlfySGTc7W5tp+5bzlnriJY

Score

10^/10

modiloader persistence trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

102fd70e1cc78fa1a648d14f9d425087_JaffaCakes118.exe

Resource

win7-20240611-en

modiloader persistence trojan upx

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

102fd70e1cc78fa1a648d14f9d425087_JaffaCakes118.exe

Resource

win10v2004-20240611-en

modiloader persistence trojan upx

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  102fd70e1cc78fa1a648d14f9d425087_JaffaCakes118
- Size
  
  157KB
- MD5
  
  102fd70e1cc78fa1a648d14f9d425087
- SHA1
  
  176473670c63643a21d796a719674a7277bcd50c
- SHA256
  
  d548e01ba094e4957b369e4bb0bc96c02559b2973879258237417e13bfeacae2
- SHA512
  
  5d7832efa7b834ef3fd1751345d71f3e7557a6f736f71743bf8a40efd884c130966452e2597308e71153270c66244b7bf97b56318b0cef89fa90bb01231791f6
- SSDEEP
  
  3072:MXAScc0i+zmLUAcO8RE5PPDlUFCyCXGAac7ZxWGC2LWp9x8pNr15bzlngqDGGWq/:M1PcaV0AHDlfySGTc7W5tp+5bzlnriJY
Score

10^/10

modiloader persistence trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- Server Software Component: Terminal Services DLL
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Deletes itself
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

Terminal Services DLL

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderpersistencetrojanupx

behavioral2

modiloaderpersistencetrojanupx

© 2018-2025

Terms | Privacy