modiloader | fe2433e043844ff8b8bdd8fa6f27739ecd0fa2ce4d784e2c2ed296dbb86d6130 | Triage

Submit
Reports

Overview

overview

Static

static

dafcbdc254...18.exe

windows7-x64

dafcbdc254...18.exe

windows10-2004-x64

Sharing

General

Target

dafcbdc25405b041923ba65831889411_JaffaCakes118
Size

206KB
Sample

240911-xa3m6awdnl
MD5

dafcbdc25405b041923ba65831889411
SHA1

4f26b638f0e1bbf38435c0317a84d563989258f3
SHA256

fe2433e043844ff8b8bdd8fa6f27739ecd0fa2ce4d784e2c2ed296dbb86d6130
SHA512

0389089412283f750a775d9cf988c4f56b6233d0646c6fba3242fe7077b78407bb1786657b749b6904a57405ac338487c997e20da0c4b4b0ad6e838e02bda3ce
SSDEEP

6144:UG7u6jrkwvKaXR0cyYLF6lcBapBdd28d:17u6jvnXRsLiATjd

Score

10^/10

modiloader defense_evasion discovery persistence trojan upx

Static task

static1

4 signatures

Behavioral task

behavioral1

Sample

dafcbdc25405b041923ba65831889411_JaffaCakes118.exe

Resource

win7-20240903-en

modiloader defense_evasion discovery persistence trojan upx

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

dafcbdc25405b041923ba65831889411_JaffaCakes118.exe

Resource

win10v2004-20240802-en

modiloader defense_evasion discovery persistence trojan upx

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  dafcbdc25405b041923ba65831889411_JaffaCakes118
- Size
  
  206KB
- MD5
  
  dafcbdc25405b041923ba65831889411
- SHA1
  
  4f26b638f0e1bbf38435c0317a84d563989258f3
- SHA256
  
  fe2433e043844ff8b8bdd8fa6f27739ecd0fa2ce4d784e2c2ed296dbb86d6130
- SHA512
  
  0389089412283f750a775d9cf988c4f56b6233d0646c6fba3242fe7077b78407bb1786657b749b6904a57405ac338487c997e20da0c4b4b0ad6e838e02bda3ce
- SSDEEP
  
  6144:UG7u6jrkwvKaXR0cyYLF6lcBapBdd28d:17u6jvnXRsLiATjd
Score

10^/10

modiloader defense_evasion discovery persistence trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- Impair Defenses: Safe Mode Boot
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

Safe Mode Boot

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdefense_evasiondiscoverypersistencetrojanupx

behavioral2

modiloaderdefense_evasiondiscoverypersistencetrojanupx

© 2018-2025

Terms | Privacy