modiloader | 9d49f4fdf73902a86a8508afe378daf2e0f2927b436793dbd7065b898451b708 | Triage

Submit
Reports

Overview

overview

Static

static

eb215c1b72...18.exe

windows7-x64

eb215c1b72...18.exe

windows10-2004-x64

Sharing

General

Target

eb215c1b7213541ef498e2874f1eaa33_JaffaCakes118
Size

20KB
Sample

240919-mekysstbqe
MD5

eb215c1b7213541ef498e2874f1eaa33
SHA1

ba50bacad454b73be9997458a609c0b832eac55d
SHA256

9d49f4fdf73902a86a8508afe378daf2e0f2927b436793dbd7065b898451b708
SHA512

8c0304341e20d16f07ccb37df535bee7a6812b4d8f409fbdf0ceea6c9ff21bf4b3fbccb1c93c877c7e0eee4e23f188f878aa63651b4cf2df1183bf77ceb02cab
SSDEEP

384:u45fLu0jm506J5rUyJ57I1k0hVRjSNAuuCf1IHOLDHE463KA:95fLu0jm506JlXJ57IfLjFgOHOLo/K

Score

10^/10

modiloader collection discovery trojan upx

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

eb215c1b7213541ef498e2874f1eaa33_JaffaCakes118.exe

Resource

win7-20240903-en

modiloader collection discovery trojan upx

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

eb215c1b7213541ef498e2874f1eaa33_JaffaCakes118.exe

Resource

win10v2004-20240802-en

modiloader discovery trojan upx

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  eb215c1b7213541ef498e2874f1eaa33_JaffaCakes118
- Size
  
  20KB
- MD5
  
  eb215c1b7213541ef498e2874f1eaa33
- SHA1
  
  ba50bacad454b73be9997458a609c0b832eac55d
- SHA256
  
  9d49f4fdf73902a86a8508afe378daf2e0f2927b436793dbd7065b898451b708
- SHA512
  
  8c0304341e20d16f07ccb37df535bee7a6812b4d8f409fbdf0ceea6c9ff21bf4b3fbccb1c93c877c7e0eee4e23f188f878aa63651b4cf2df1183bf77ceb02cab
- SSDEEP
  
  384:u45fLu0jm506J5rUyJ57I1k0hVRjSNAuuCf1IHOLDHE463KA:95fLu0jm506JlXJ57IfLjFgOHOLo/K
Score

10^/10

modiloader collection discovery trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloadercollectiondiscoverytrojanupx

behavioral2

modiloaderdiscoverytrojanupx

© 2018-2025

Terms | Privacy