modiloader | af5b42def8c31a29a0e9b3b1fe012fe1242576b6b7363ef284f00585db2cf216

General

Target

ad8001f4331f0e3bc24808981425b799_JaffaCakes118
Size

264KB
Sample

240820-cl7e9ssell
MD5

ad8001f4331f0e3bc24808981425b799
SHA1

31744f6da6e372581819a9c201223b5955b1c035
SHA256

af5b42def8c31a29a0e9b3b1fe012fe1242576b6b7363ef284f00585db2cf216
SHA512

5984ce4d32f63287cefe394150246b0ad677543f70b2eea2ab5c24ed608343c0605de7d249ca392e3605003701898b1c3dbe03e63618fad89753a2aeea7adb41
SSDEEP

3072:Lh8YRHE5GsBZCu9MxOLMJj9A0XSQooWzI3jnmyd1mUDPekZ/eUXyHAQyVWCSWFyQ:18C0GAZCvac7SiZjJ7beUXy0Vzy+FE8F

Score

10^/10

Malware Config

Targets

- Target
  
  ad8001f4331f0e3bc24808981425b799_JaffaCakes118
- Size
  
  264KB
- MD5
  
  ad8001f4331f0e3bc24808981425b799
- SHA1
  
  31744f6da6e372581819a9c201223b5955b1c035
- SHA256
  
  af5b42def8c31a29a0e9b3b1fe012fe1242576b6b7363ef284f00585db2cf216
- SHA512
  
  5984ce4d32f63287cefe394150246b0ad677543f70b2eea2ab5c24ed608343c0605de7d249ca392e3605003701898b1c3dbe03e63618fad89753a2aeea7adb41
- SSDEEP
  
  3072:Lh8YRHE5GsBZCu9MxOLMJj9A0XSQooWzI3jnmyd1mUDPekZ/eUXyHAQyVWCSWFyQ:18C0GAZCvac7SiZjJ7beUXy0Vzy+FE8F
Score

10^/10

modiloader discovery trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ModiLoader, DBatLoader

ModiLoader Second Stage

Drops file in Drivers directory

Drops startup file

Executes dropped EXE

Loads dropped DLL

UPX packed file

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2