modiloader | 46251191d43b705f4d042d43d6b54b7ed6f87a78ccc02c2e36f9140f513074fe | Triage

Submit
Reports

Overview

overview

Static

static

3

e29773477a...18.exe

windows7-x64

e29773477a...18.exe

windows10-2004-x64

7

Sharing

General

Target

e29773477a0c8d5f8571b16649b0dc8a_JaffaCakes118
Size

1.6MB
Sample

240915-qrtm9avhka
MD5

e29773477a0c8d5f8571b16649b0dc8a
SHA1

9d09430a2b453779f73937ee6c754ccd00fcfd71
SHA256

46251191d43b705f4d042d43d6b54b7ed6f87a78ccc02c2e36f9140f513074fe
SHA512

3c3cc638bc9a364e5c6df1ad8b3e353d26595f0320aaee96ece32e5d4b4b353477c0a456c74d15b106fbc8e40bcc76b0efe0fdc09ee42e13f7555fe60e1f5e3f
SSDEEP

49152:4J4Icp4IEbxXycj3gKlgWZtkEkPQxErYJA8WxRO:0GEbxzwItkNPQiG

Score

10^/10

modiloader discovery evasion trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

e29773477a0c8d5f8571b16649b0dc8a_JaffaCakes118.exe

Resource

win7-20240903-en

modiloader discovery evasion trojan

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

e29773477a0c8d5f8571b16649b0dc8a_JaffaCakes118.exe

Resource

win10v2004-20240802-en

discovery evasion

windows10-2004-x64

2 signatures

150 seconds

Malware Config

Targets

- Target
  
  e29773477a0c8d5f8571b16649b0dc8a_JaffaCakes118
- Size
  
  1.6MB
- MD5
  
  e29773477a0c8d5f8571b16649b0dc8a
- SHA1
  
  9d09430a2b453779f73937ee6c754ccd00fcfd71
- SHA256
  
  46251191d43b705f4d042d43d6b54b7ed6f87a78ccc02c2e36f9140f513074fe
- SHA512
  
  3c3cc638bc9a364e5c6df1ad8b3e353d26595f0320aaee96ece32e5d4b4b353477c0a456c74d15b106fbc8e40bcc76b0efe0fdc09ee42e13f7555fe60e1f5e3f
- SSDEEP
  
  49152:4J4Icp4IEbxXycj3gKlgWZtkEkPQxErYJA8WxRO:0GEbxzwItkNPQiG
Score

10^/10

modiloader discovery evasion trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoveryevasiontrojan

behavioral2

discoveryevasion

© 2018-2025

Terms | Privacy