modiloader | 7dc7f43c3f7cdb6a9e4bbfbdf69eb67eccfdf6daa9a30d1e41bb23cf0a7fa2fa

General

Target

d468861d749a6593c0dbb2f274bc0cd2_JaffaCakes118
Size

395KB
Sample

240908-p5zkzsxbrq
MD5

d468861d749a6593c0dbb2f274bc0cd2
SHA1

aba90293044085b52c514a10db98e7c8f98d4cec
SHA256

7dc7f43c3f7cdb6a9e4bbfbdf69eb67eccfdf6daa9a30d1e41bb23cf0a7fa2fa
SHA512

a4a0cb24dcdda9b5f74a0da7788faf84694bc0fc3206b26f513370f159197e43d665664470f49124dfb2dffed7077d75924ab3828a0ec17aac5debe2bdd564d3
SSDEEP

6144:ReE94FPz0lDqg3V0YMwebiM1ut1oWTiO1Vazac/ycLXY9zuyr691lFrXfp5WqAZ:ReEO7UDqg3VxO31q1oPqc/tcQRR5WR

Score

10^/10

Malware Config

Targets

- Target
  
  d468861d749a6593c0dbb2f274bc0cd2_JaffaCakes118
- Size
  
  395KB
- MD5
  
  d468861d749a6593c0dbb2f274bc0cd2
- SHA1
  
  aba90293044085b52c514a10db98e7c8f98d4cec
- SHA256
  
  7dc7f43c3f7cdb6a9e4bbfbdf69eb67eccfdf6daa9a30d1e41bb23cf0a7fa2fa
- SHA512
  
  a4a0cb24dcdda9b5f74a0da7788faf84694bc0fc3206b26f513370f159197e43d665664470f49124dfb2dffed7077d75924ab3828a0ec17aac5debe2bdd564d3
- SSDEEP
  
  6144:ReE94FPz0lDqg3V0YMwebiM1ut1oWTiO1Vazac/ycLXY9zuyr691lFrXfp5WqAZ:ReEO7UDqg3VxO31q1oPqc/tcQRR5WR
Score

10^/10

modiloader discovery evasion execution persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Adds policy Run key to start application
  persistence
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2