modiloader | b70469d8c92cf656312410cb70856052a1a3a5acf86c6ce56886e0cb0af1689a

General

Target

e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118
Size

240KB
Sample

240914-xfxzvszbjq
MD5

e0ced5e9d4ed7f8ea0ba5e616df4ab4a
SHA1

61933f101244016284f26eb8ed50bbeaef2d0bc8
SHA256

b70469d8c92cf656312410cb70856052a1a3a5acf86c6ce56886e0cb0af1689a
SHA512

ac34c1aa5ce669e9bcf87e25130d389f7c67bc1211542f8b2caecb68e8960c6cb21bb4aaf37b9425e984737df90ae67fb6e56e833b35785ebeb3639029a349f4
SSDEEP

6144:6KzkPr4yfkDAp18uJmp8DO9AHYPvRV/5HBQqjqRY2:6Kmr4yfkDAb8r2Oyaj/vqRY2

Score

10^/10

Malware Config

Targets

- Target
  
  e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118
- Size
  
  240KB
- MD5
  
  e0ced5e9d4ed7f8ea0ba5e616df4ab4a
- SHA1
  
  61933f101244016284f26eb8ed50bbeaef2d0bc8
- SHA256
  
  b70469d8c92cf656312410cb70856052a1a3a5acf86c6ce56886e0cb0af1689a
- SHA512
  
  ac34c1aa5ce669e9bcf87e25130d389f7c67bc1211542f8b2caecb68e8960c6cb21bb4aaf37b9425e984737df90ae67fb6e56e833b35785ebeb3639029a349f4
- SSDEEP
  
  6144:6KzkPr4yfkDAp18uJmp8DO9AHYPvRV/5HBQqjqRY2:6Kmr4yfkDAb8r2Oyaj/vqRY2
Score

10^/10

modiloader discovery evasion execution persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2