modiloader | 4e58ce8d327985f314bdfd54db5c55068adc4dfcc3f326d09994c96ee9a40fbe | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

e06c69c495...18.exe

windows7-x64

e06c69c495...18.exe

windows10-2004-x64

Sharing

General

Target

e06c69c49584c658bc6d763b23be5a96_JaffaCakes118
Size

271KB
Sample

240914-sayxrazfpc
MD5

e06c69c49584c658bc6d763b23be5a96
SHA1

c9f23e2ae268bcefbf346d37dc1a03c3df1ede90
SHA256

4e58ce8d327985f314bdfd54db5c55068adc4dfcc3f326d09994c96ee9a40fbe
SHA512

ef278781d3eb6eb34382d968cad6452ec3a71f6a618aa4134fbb01837ccb4ea5c7a713e14fddc465b2f4129c9b987333a2f1e79ae5e4d69083e3e59d6eb6dca1
SSDEEP

6144:un04iaqbh4l26Px8c/mcbwBDzQiI9QKDQ38IFnAmvHQN8F7L+:Z4iaqal2wqhI9J8MIFnAmoN8Q

Score

10^/10

modiloader discovery trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

e06c69c49584c658bc6d763b23be5a96_JaffaCakes118.exe

Resource

win7-20240708-en

modiloader discovery trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

e06c69c49584c658bc6d763b23be5a96_JaffaCakes118.exe

Resource

win10v2004-20240802-en

modiloader discovery trojan

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  e06c69c49584c658bc6d763b23be5a96_JaffaCakes118
- Size
  
  271KB
- MD5
  
  e06c69c49584c658bc6d763b23be5a96
- SHA1
  
  c9f23e2ae268bcefbf346d37dc1a03c3df1ede90
- SHA256
  
  4e58ce8d327985f314bdfd54db5c55068adc4dfcc3f326d09994c96ee9a40fbe
- SHA512
  
  ef278781d3eb6eb34382d968cad6452ec3a71f6a618aa4134fbb01837ccb4ea5c7a713e14fddc465b2f4129c9b987333a2f1e79ae5e4d69083e3e59d6eb6dca1
- SSDEEP
  
  6144:un04iaqbh4l26Px8c/mcbwBDzQiI9QKDQ38IFnAmvHQN8F7L+:Z4iaqal2wqhI9J8MIFnAmoN8Q
Score

10^/10

modiloader discovery trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- Deletes itself
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoverytrojan

behavioral2

modiloaderdiscoverytrojan

© 2018-2025

Terms | Privacy