modiloader | a6ad5f33ce750fd4b92d385eab9cf73e8939f1211c73ccf37c911c8648c808ee | Triage

Submit
Reports

Overview

overview

Static

static

3

f0e9fe1ca9...18.exe

windows7-x64

f0e9fe1ca9...18.exe

windows10-2004-x64

Sharing

General

Target

f0e9fe1ca958f85ae72a30b4fcf0b84b_JaffaCakes118
Size

925KB
Sample

240922-aplxmaseqj
MD5

f0e9fe1ca958f85ae72a30b4fcf0b84b
SHA1

680e3bf50fb3143b309358aa061460c402fbd022
SHA256

a6ad5f33ce750fd4b92d385eab9cf73e8939f1211c73ccf37c911c8648c808ee
SHA512

0a340f18872e095fc4a2d4770126216e70fa3f5d25b4f45a8bc84acc9608167fad99c077c6b3c75c218a7d5fef464ae93e95d965c092f047dc4e5d8cd5b91e1c
SSDEEP

12288:Mko7YNQ5s4WioPJicryGBWECTqCpWG1lHAJfKEtDWXNpby4d8IEXu5otUi/gh7ps:MdwQH6icoECFpWylHAy8IYQo6zNwBJ

Score

10^/10

modiloader discovery evasion persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

f0e9fe1ca958f85ae72a30b4fcf0b84b_JaffaCakes118.exe

Resource

win7-20240903-en

modiloader discovery evasion persistence trojan

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

f0e9fe1ca958f85ae72a30b4fcf0b84b_JaffaCakes118.exe

Resource

win10v2004-20240802-en

modiloader discovery evasion persistence trojan

windows10-2004-x64

18 signatures

150 seconds

Malware Config

Targets

- Target
  
  f0e9fe1ca958f85ae72a30b4fcf0b84b_JaffaCakes118
- Size
  
  925KB
- MD5
  
  f0e9fe1ca958f85ae72a30b4fcf0b84b
- SHA1
  
  680e3bf50fb3143b309358aa061460c402fbd022
- SHA256
  
  a6ad5f33ce750fd4b92d385eab9cf73e8939f1211c73ccf37c911c8648c808ee
- SHA512
  
  0a340f18872e095fc4a2d4770126216e70fa3f5d25b4f45a8bc84acc9608167fad99c077c6b3c75c218a7d5fef464ae93e95d965c092f047dc4e5d8cd5b91e1c
- SSDEEP
  
  12288:Mko7YNQ5s4WioPJicryGBWECTqCpWG1lHAJfKEtDWXNpby4d8IEXu5otUi/gh7ps:MdwQH6icoECFpWylHAy8IYQo6zNwBJ
Score

10^/10

modiloader discovery evasion persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- UAC bypass
  evasion trojan
- ModiLoader Second Stage
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoveryevasionpersistencetrojan

behavioral2

modiloaderdiscoveryevasionpersistencetrojan

© 2018-2025

Terms | Privacy