modiloader | 1910eec1c97db1203b122666d465216b9cf7f5582128a3a0f158852261b296b7

General

Target

e39b73ada152cdf38c798d4f1a3adcae_JaffaCakes118
Size

320KB
Sample

240915-3sfh8sybld
MD5

e39b73ada152cdf38c798d4f1a3adcae
SHA1

d0930ef2e3c7fe77323fb63100fd47a6e1036b52
SHA256

1910eec1c97db1203b122666d465216b9cf7f5582128a3a0f158852261b296b7
SHA512

bb19cfd02e1a5205a2d4285777a5604ea290b71af938855c31483d28b0ba7ad9ce4809b77801c1dd9a7168830d17ce4029d4ebedd28b84d6b0aa2acfc34bff20
SSDEEP

6144:q+ipCoE71yADLfDWOaBXBo534uwJnFGOmaU5:Nip7E7/L0BY34uU7pw

Score

10^/10

Malware Config

Targets

- Target
  
  e39b73ada152cdf38c798d4f1a3adcae_JaffaCakes118
- Size
  
  320KB
- MD5
  
  e39b73ada152cdf38c798d4f1a3adcae
- SHA1
  
  d0930ef2e3c7fe77323fb63100fd47a6e1036b52
- SHA256
  
  1910eec1c97db1203b122666d465216b9cf7f5582128a3a0f158852261b296b7
- SHA512
  
  bb19cfd02e1a5205a2d4285777a5604ea290b71af938855c31483d28b0ba7ad9ce4809b77801c1dd9a7168830d17ce4029d4ebedd28b84d6b0aa2acfc34bff20
- SSDEEP
  
  6144:q+ipCoE71yADLfDWOaBXBo534uwJnFGOmaU5:Nip7E7/L0BY34uU7pw
Score

10^/10

modiloader discovery evasion execution persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Adds policy Run key to start application
  persistence
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2