modiloader | 672ecd7611eab0c43743689bf72bdaa6290993035c7111d73e85337ec74cbde0 | Triage

Submit
Reports

Overview

overview

Static

static

3

f6379e8511...18.exe

windows7-x64

f6379e8511...18.exe

windows10-2004-x64

Sharing

General

Target

f6379e8511685e6a418cf41481f39271_JaffaCakes118
Size

679KB
Sample

240925-rve5pstenf
MD5

f6379e8511685e6a418cf41481f39271
SHA1

753b2298971f49eb3837381636c8932e380dd705
SHA256

672ecd7611eab0c43743689bf72bdaa6290993035c7111d73e85337ec74cbde0
SHA512

6fbd4c99b04ca470efcf379068807bb48f858b9f8f1f2aeecd9805e313b11914aa3c0aaf409bd02b22e3c759474517304fd13dae64badc62568a7d9af1c41a11
SSDEEP

12288:bhIs42W5S9THvzrtp5tJOg2+eUlJv3nmQeF3VJ05WkF3Z4mxxnDqVTVOCC:bhIv2W5Evzrn5jOgdlJvmrfYQmX2VTzC

Score

10^/10

modiloader discovery persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

f6379e8511685e6a418cf41481f39271_JaffaCakes118.exe

Resource

win7-20240903-en

modiloader discovery persistence trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

f6379e8511685e6a418cf41481f39271_JaffaCakes118.exe

Resource

win10v2004-20240802-en

modiloader discovery persistence trojan

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  f6379e8511685e6a418cf41481f39271_JaffaCakes118
- Size
  
  679KB
- MD5
  
  f6379e8511685e6a418cf41481f39271
- SHA1
  
  753b2298971f49eb3837381636c8932e380dd705
- SHA256
  
  672ecd7611eab0c43743689bf72bdaa6290993035c7111d73e85337ec74cbde0
- SHA512
  
  6fbd4c99b04ca470efcf379068807bb48f858b9f8f1f2aeecd9805e313b11914aa3c0aaf409bd02b22e3c759474517304fd13dae64badc62568a7d9af1c41a11
- SSDEEP
  
  12288:bhIs42W5S9THvzrtp5tJOg2+eUlJv3nmQeF3VJ05WkF3Z4mxxnDqVTVOCC:bhIv2W5Evzrn5jOgdlJvmrfYQmX2VTzC
Score

10^/10

modiloader discovery persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoverypersistencetrojan

behavioral2

modiloaderdiscoverypersistencetrojan

© 2018-2025

Terms | Privacy