modiloader | 828db9ff37cd310b366df075b0e9a56f1dfa2b37860323e67a38b6adc0c25e69 | Triage

Submit
Reports

Overview

overview

Static

static

3

f0e964545f...18.exe

windows7-x64

f0e964545f...18.exe

windows10-2004-x64

7

Sharing

General

Target

f0e964545fb9be3164d2e809cfdda727_JaffaCakes118
Size

2.6MB
Sample

240922-angarasekn
MD5

f0e964545fb9be3164d2e809cfdda727
SHA1

d32a33ffed32269d0463ac319700ea43120bca95
SHA256

828db9ff37cd310b366df075b0e9a56f1dfa2b37860323e67a38b6adc0c25e69
SHA512

ffb51f711a593f6169760358b9c22d81eb6fb4b0daa9d5c0f62ab94ae90c98ddf8cb7ec1eebd1efa283accb6a0c0b05f32e9dda77a293e0d798ca7f8c01f9208
SSDEEP

49152:1i1453jShuUAmXchLvsuT881XwpzczXZEIqZS7/cs64EsP9+93B5f:1e453jEL40KgBaXZEbS7Ux4EC+vV

Score

10^/10

modiloader discovery evasion trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

f0e964545fb9be3164d2e809cfdda727_JaffaCakes118.exe

Resource

win7-20240903-en

modiloader discovery evasion trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

f0e964545fb9be3164d2e809cfdda727_JaffaCakes118.exe

Resource

win10v2004-20240802-en

discovery evasion trojan

windows10-2004-x64

3 signatures

150 seconds

Malware Config

Targets

- Target
  
  f0e964545fb9be3164d2e809cfdda727_JaffaCakes118
- Size
  
  2.6MB
- MD5
  
  f0e964545fb9be3164d2e809cfdda727
- SHA1
  
  d32a33ffed32269d0463ac319700ea43120bca95
- SHA256
  
  828db9ff37cd310b366df075b0e9a56f1dfa2b37860323e67a38b6adc0c25e69
- SHA512
  
  ffb51f711a593f6169760358b9c22d81eb6fb4b0daa9d5c0f62ab94ae90c98ddf8cb7ec1eebd1efa283accb6a0c0b05f32e9dda77a293e0d798ca7f8c01f9208
- SSDEEP
  
  49152:1i1453jShuUAmXchLvsuT881XwpzczXZEIqZS7/cs64EsP9+93B5f:1e453jEL40KgBaXZEbS7Ux4EC+vV
Score

10^/10

modiloader discovery evasion trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoveryevasiontrojan

behavioral2

discoveryevasiontrojan

© 2018-2025

Terms | Privacy