modiloader | 39a3d42c051389be8c9743e097e1c53a1d119360d4f346b0809726ed42306665 | Triage

Submit
Reports

Overview

overview

Static

static

3

68ab36de0b...18.exe

windows7-x64

68ab36de0b...18.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

68ab36de0b34e529b6ddd96c8f98075b_JaffaCakes118
Size

449KB
Sample

240723-ygmqysthql
MD5

68ab36de0b34e529b6ddd96c8f98075b
SHA1

ab77409aa0e5af627ab7cf5cf3c6bd60842020c2
SHA256

39a3d42c051389be8c9743e097e1c53a1d119360d4f346b0809726ed42306665
SHA512

f20791515d7c55a55690baf4dc0e6399c94542a8943193ba916bc0e84e73242db1d5301adfe0b7813d8c57a2ef71bf0dd9f3bd6d0a2fc7ecfe32985e766a248c
SSDEEP

6144:JIbvnxNLgaJ5l72Xb+RgTWKvkPvy6nPuupjf3hEsjH8ZRwnt6l+vCTEM0Mb55yZ8:JmvHgU/OCPK8y6im9FiEXMiTF8

Score

10^/10

modiloader discovery evasion persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

68ab36de0b34e529b6ddd96c8f98075b_JaffaCakes118.exe

Resource

win7-20240708-en

modiloader discovery evasion persistence trojan

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

68ab36de0b34e529b6ddd96c8f98075b_JaffaCakes118.exe

Resource

win10v2004-20240709-en

modiloader discovery evasion persistence trojan

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  68ab36de0b34e529b6ddd96c8f98075b_JaffaCakes118
- Size
  
  449KB
- MD5
  
  68ab36de0b34e529b6ddd96c8f98075b
- SHA1
  
  ab77409aa0e5af627ab7cf5cf3c6bd60842020c2
- SHA256
  
  39a3d42c051389be8c9743e097e1c53a1d119360d4f346b0809726ed42306665
- SHA512
  
  f20791515d7c55a55690baf4dc0e6399c94542a8943193ba916bc0e84e73242db1d5301adfe0b7813d8c57a2ef71bf0dd9f3bd6d0a2fc7ecfe32985e766a248c
- SSDEEP
  
  6144:JIbvnxNLgaJ5l72Xb+RgTWKvkPvy6nPuupjf3hEsjH8ZRwnt6l+vCTEM0Mb55yZ8:JmvHgU/OCPK8y6im9FiEXMiTF8
Score

10^/10

modiloader discovery evasion persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modifies firewall policy service
  evasion
- ModiLoader Second Stage
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoveryevasionpersistencetrojan

behavioral2

modiloaderdiscoveryevasionpersistencetrojan

© 2018-2025

Terms | Privacy