modiloader | e7014f11f1dec0f01eb679487d2160a39dd222ccc647b3bc23617ebcfec61f65 | Triage

Sharing

General

Target

e81188808ba8a5b5d302e1800d5fe50e_JaffaCakes118
Size

114KB
Sample

240918-bwle4swcqn
MD5

e81188808ba8a5b5d302e1800d5fe50e
SHA1

1b50461c2a5422b92464c04d2995bb3d5deec1e9
SHA256

e7014f11f1dec0f01eb679487d2160a39dd222ccc647b3bc23617ebcfec61f65
SHA512

b47fa856734a9d08b54a30f67501a1c76be64a85f51f8c8a32202d9d7fa8c3267dc9401458939deae7ae18cfa21c14a1fa5344b964ba4890f37a7a373a44b244
SSDEEP

3072:uoiCEf6FnEf2WVeS+2mOf8lfB8HnVKZTnXP:ugn5Ef1X+Uf8lfB8HVKZb

Score

10^/10

modiloader adware discovery evasion stealer trojan

Malware Config

Targets

- Target
  
  e81188808ba8a5b5d302e1800d5fe50e_JaffaCakes118
- Size
  
  114KB
- MD5
  
  e81188808ba8a5b5d302e1800d5fe50e
- SHA1
  
  1b50461c2a5422b92464c04d2995bb3d5deec1e9
- SHA256
  
  e7014f11f1dec0f01eb679487d2160a39dd222ccc647b3bc23617ebcfec61f65
- SHA512
  
  b47fa856734a9d08b54a30f67501a1c76be64a85f51f8c8a32202d9d7fa8c3267dc9401458939deae7ae18cfa21c14a1fa5344b964ba4890f37a7a373a44b244
- SSDEEP
  
  3072:uoiCEf6FnEf2WVeS+2mOf8lfB8HnVKZTnXP:ugn5Ef1X+Uf8lfB8HVKZb
Score

10^/10

modiloader adware discovery evasion stealer trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modifies firewall policy service
  evasion
- ModiLoader Second Stage
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderadwarediscoveryevasionstealertrojan

behavioral2

modiloaderadwarediscoveryevasionstealertrojan