modiloader | 350b3401252bc6dda2c95606516ea43bdf08a54513e5cec21e55ded632e8b73b | Triage

Submit
Reports

Overview

overview

Static

static

7

5ae3cafa34...18.exe

windows7-x64

5ae3cafa34...18.exe

windows10-2004-x64

7

Sharing

General

Target

5ae3cafa3421ea2fb73b1648e20e5597_JaffaCakes118
Size

785KB
Sample

240719-hpwe3axfqj
MD5

5ae3cafa3421ea2fb73b1648e20e5597
SHA1

65e7f9b3e7456b9f525eb99d6b23a4713c27f22d
SHA256

350b3401252bc6dda2c95606516ea43bdf08a54513e5cec21e55ded632e8b73b
SHA512

003b5a7305b8311fe81305d057a255f7b3cc6caee29adf5bf0beeaed1114a4d1ad373b1bdb8b581369768a97e0114b5e8a5c8b7f4705c8f8dcee7b7f66be5281
SSDEEP

12288:u8/iRtoxzCImiq4LSnziWHs5RFmO6lQOzEme4yV7rjmlXWAK5gWyMwYncq3g93i:uSC2xzCeSqrzgTz2vVPjml5n8ND3g9y

Score

10^/10

modiloader evasion themida trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

5ae3cafa3421ea2fb73b1648e20e5597_JaffaCakes118.exe

Resource

win7-20240708-en

modiloader evasion themida trojan

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

5ae3cafa3421ea2fb73b1648e20e5597_JaffaCakes118.exe

Resource

win10v2004-20240709-en

evasion themida

windows10-2004-x64

3 signatures

150 seconds

Malware Config

Targets

- Target
  
  5ae3cafa3421ea2fb73b1648e20e5597_JaffaCakes118
- Size
  
  785KB
- MD5
  
  5ae3cafa3421ea2fb73b1648e20e5597
- SHA1
  
  65e7f9b3e7456b9f525eb99d6b23a4713c27f22d
- SHA256
  
  350b3401252bc6dda2c95606516ea43bdf08a54513e5cec21e55ded632e8b73b
- SHA512
  
  003b5a7305b8311fe81305d057a255f7b3cc6caee29adf5bf0beeaed1114a4d1ad373b1bdb8b581369768a97e0114b5e8a5c8b7f4705c8f8dcee7b7f66be5281
- SSDEEP
  
  12288:u8/iRtoxzCImiq4LSnziWHs5RFmO6lQOzEme4yV7rjmlXWAK5gWyMwYncq3g93i:uSC2xzCeSqrzgTz2vVPjml5n8ND3g9y
Score

10^/10

modiloader evasion themida trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- UAC bypass
  evasion trojan
- ModiLoader Second Stage
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderevasionthemidatrojan

behavioral2

© 2018-2025

Terms | Privacy