modiloader | f23e3eabae81ebfdfa4f0767f0c7a67bee3ebc8aabb777287fa88d4569c89c83 | Triage

Submit
Reports

Overview

overview

Static

static

3

e6f7a37e7b...18.exe

windows7-x64

7

e6f7a37e7b...18.exe

windows10-2004-x64

Sharing

General

Target

e6f7a37e7b2e14088e37bcf35d055a59_JaffaCakes118
Size

285KB
Sample

240917-q8b5jawhkq
MD5

e6f7a37e7b2e14088e37bcf35d055a59
SHA1

7122b88dc46bf377da03d8905c13b7ddc890dda7
SHA256

f23e3eabae81ebfdfa4f0767f0c7a67bee3ebc8aabb777287fa88d4569c89c83
SHA512

5adf51e89761e87e8f422e7b089300e5725affb9d9b3777632499d845c5897ffd135a95f0fb8d24d61d2fa31c128521c96717bd3b41d8f95fd191277bf487313
SSDEEP

6144:HeBIAx9vZC8qVoIZ02jTelH98gWNlPTGQQm6agrd:HKVXCT82He8NtTird

Score

10^/10

modiloader bootkit defense_evasion discovery persistence trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

e6f7a37e7b2e14088e37bcf35d055a59_JaffaCakes118.exe

Resource

win7-20240903-en

bootkit defense_evasion discovery persistence upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

e6f7a37e7b2e14088e37bcf35d055a59_JaffaCakes118.exe

Resource

win10v2004-20240802-en

modiloader defense_evasion discovery trojan upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  e6f7a37e7b2e14088e37bcf35d055a59_JaffaCakes118
- Size
  
  285KB
- MD5
  
  e6f7a37e7b2e14088e37bcf35d055a59
- SHA1
  
  7122b88dc46bf377da03d8905c13b7ddc890dda7
- SHA256
  
  f23e3eabae81ebfdfa4f0767f0c7a67bee3ebc8aabb777287fa88d4569c89c83
- SHA512
  
  5adf51e89761e87e8f422e7b089300e5725affb9d9b3777632499d845c5897ffd135a95f0fb8d24d61d2fa31c128521c96717bd3b41d8f95fd191277bf487313
- SSDEEP
  
  6144:HeBIAx9vZC8qVoIZ02jTelH98gWNlPTGQQm6agrd:HKVXCT82He8NtTird
Score

10^/10

bootkit defense_evasion discovery persistence upx modiloader trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- Deletes itself
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Pre-OS Boot

Bootkit

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdefense_evasiondiscoverypersistenceupx

behavioral2

modiloaderdefense_evasiondiscoverytrojanupx

© 2018-2025

Terms | Privacy