modiloader | be51b3560672fff258c96921b44908a71669bbcad656c251574cc4b289c929f0

General

Target
247ae41b40c7b401f74463a5901d4c3b_JaffaCakes118
Size 209KB
Sample240704-d2vbbascpn
SHA256 be51b3560672fff258c96921b44908a71669bbcad656c251574cc4b289c929f0
MD5 247ae41b40c7b401f74463a5901d4c3b
SHA1 2cb95702226c2df2b1a84cdb99223891795fffdc
SHA512 86c73c8596997abe01c690aa7aa52f5b38e865f0d1ae71a0569546348bbd0087a4ebe037517d3e7e720db5dd321032a6fb868295093388a8bc19285183f2b6c5
SSDEEP 3072:fvYHspRKx4EwcbcQKDKOGT6oP23DKXKvuul8BGgHYX/FcOSWvhPdHq4OmLbU21JW:H3RK83D5c23jGGxdjCeg29a3YXNne
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  247ae41b40c7b401f74463a5901d4c3b_JaffaCakes118
- Size 209KB
- SHA256 be51b3560672fff258c96921b44908a71669bbcad656c251574cc4b289c929f0
- MD5 247ae41b40c7b401f74463a5901d4c3b
- SHA1 2cb95702226c2df2b1a84cdb99223891795fffdc
- SHA512 86c73c8596997abe01c690aa7aa52f5b38e865f0d1ae71a0569546348bbd0087a4ebe037517d3e7e720db5dd321032a6fb868295093388a8bc19285183f2b6c5
- SSDEEP 3072:fvYHspRKx4EwcbcQKDKOGT6oP23DKXKvuul8BGgHYX/FcOSWvhPdHq4OmLbU21JW:H3RK83D5c23jGGxdjCeg29a3YXNne
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

modiloader persistence trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- Server Software Component: Terminal Services DLL
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ModiLoader, DBatLoader

ModiLoader Second Stage

Server Software Component: Terminal Services DLL

ACProtect 1.3x - 1.4x DLL software

Loads dropped DLL

UPX packed file

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2