modiloader | 6ecac628b6fae0ea6a585b5b3c14147c4e604b4b12b2963311bdb20ed016e5b6

General

Target

df2b46519d33bdb827c5cad1953f4205_JaffaCakes118
Size

89KB
Sample

240914-at4y1axdrq
MD5

df2b46519d33bdb827c5cad1953f4205
SHA1

c28e2ad43ef220d271aa3704729c26f44066e6c8
SHA256

6ecac628b6fae0ea6a585b5b3c14147c4e604b4b12b2963311bdb20ed016e5b6
SHA512

c7859155e64523154dfabbe954ed83638122e922df055692b5707bcde3c42a0405737e679f88c92457fe153544e940aa4282ba9f5f7035cc1462f58291fcca40
SSDEEP

1536:ncHA5dZuvrKA1r4Jwwi55dlvo89UBYKpJ0pHWG7m9pAsiyR9NqtgUU74w8U:ncg7UrKqUwflAZYKX6aAsiydELA4

Score

10^/10

Malware Config

Targets

- Target
  
  df2b46519d33bdb827c5cad1953f4205_JaffaCakes118
- Size
  
  89KB
- MD5
  
  df2b46519d33bdb827c5cad1953f4205
- SHA1
  
  c28e2ad43ef220d271aa3704729c26f44066e6c8
- SHA256
  
  6ecac628b6fae0ea6a585b5b3c14147c4e604b4b12b2963311bdb20ed016e5b6
- SHA512
  
  c7859155e64523154dfabbe954ed83638122e922df055692b5707bcde3c42a0405737e679f88c92457fe153544e940aa4282ba9f5f7035cc1462f58291fcca40
- SSDEEP
  
  1536:ncHA5dZuvrKA1r4Jwwi55dlvo89UBYKpJ0pHWG7m9pAsiyR9NqtgUU74w8U:ncg7UrKqUwflAZYKX6aAsiydELA4
Score

10^/10

modiloader discovery trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ModiLoader, DBatLoader

ModiLoader Second Stage

Checks computer location settings

Deletes itself

Drops startup file

Executes dropped EXE

Loads dropped DLL

UPX packed file

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2