modiloader | 7985be15f3338fab9505384a1e2539c8a87ef0653a61425a2977f78902437c22

General

Target

eac97d7e01d0b3b14f85bb97239ecac5_JaffaCakes118
Size

3.4MB
Sample

240919-hjz63awcnp
MD5

eac97d7e01d0b3b14f85bb97239ecac5
SHA1

844549ca14a6105a77754aafdeba6002c190dd58
SHA256

7985be15f3338fab9505384a1e2539c8a87ef0653a61425a2977f78902437c22
SHA512

238aa38351ca0e0e40cd967eee5a1e38a4063ca00452dff128e7bde088f6656451112a50b3aae237ac6391489f76017974a2d31ab95d9245b9b3216659a6423e
SSDEEP

98304:f0bUWxYqdwkLcHHLotY2gx7qpFp/xdt++NQkx:f0bzjALlGfBxz+EQ0

Score

10^/10

Malware Config

Targets

- Target
  
  eac97d7e01d0b3b14f85bb97239ecac5_JaffaCakes118
- Size
  
  3.4MB
- MD5
  
  eac97d7e01d0b3b14f85bb97239ecac5
- SHA1
  
  844549ca14a6105a77754aafdeba6002c190dd58
- SHA256
  
  7985be15f3338fab9505384a1e2539c8a87ef0653a61425a2977f78902437c22
- SHA512
  
  238aa38351ca0e0e40cd967eee5a1e38a4063ca00452dff128e7bde088f6656451112a50b3aae237ac6391489f76017974a2d31ab95d9245b9b3216659a6423e
- SSDEEP
  
  98304:f0bUWxYqdwkLcHHLotY2gx7qpFp/xdt++NQkx:f0bzjALlGfBxz+EQ0
Score

10^/10

modiloader aspackv2 discovery trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ModiLoader, DBatLoader

ModiLoader Second Stage

ACProtect 1.3x - 1.4x DLL software

ASPack v2.12-2.42

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2