modiloader | 4d22f64874665c233a0ff8092f98a8320908058a45fbd535b042c3c31fd3c993 | Triage

Submit
Reports

Overview

overview

Static

static

7

fa3ba3247a...18.exe

windows7-x64

fa3ba3247a...18.exe

windows10-2004-x64

7

Sharing

General

Target

fa3ba3247af3ef3d0f814a62a3e62497_JaffaCakes118
Size

1.6MB
Sample

240927-mgd82azhnf
MD5

fa3ba3247af3ef3d0f814a62a3e62497
SHA1

b7f72fc763c2190995348112d2c81100edd667b5
SHA256

4d22f64874665c233a0ff8092f98a8320908058a45fbd535b042c3c31fd3c993
SHA512

90b322f47bde6ad80d4701d239fcae2d22ba5f430cc4c98a5294f0e4bc899ab5d34b000d2acf124a04e3654e1b0e962e1941d7418f478a921ddece72841f94ad
SSDEEP

49152:F/+nwLepp/O2r1+AFhHBGF5nX2nCTNcOCFinZ:owLK5O2oArhnCT6inZ

Score

10^/10

modiloader discovery evasion themida trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

fa3ba3247af3ef3d0f814a62a3e62497_JaffaCakes118.exe

Resource

win7-20240903-en

modiloader discovery evasion themida trojan

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

fa3ba3247af3ef3d0f814a62a3e62497_JaffaCakes118.exe

Resource

win10v2004-20240802-en

discovery evasion themida

windows10-2004-x64

3 signatures

150 seconds

Malware Config

Targets

- Target
  
  fa3ba3247af3ef3d0f814a62a3e62497_JaffaCakes118
- Size
  
  1.6MB
- MD5
  
  fa3ba3247af3ef3d0f814a62a3e62497
- SHA1
  
  b7f72fc763c2190995348112d2c81100edd667b5
- SHA256
  
  4d22f64874665c233a0ff8092f98a8320908058a45fbd535b042c3c31fd3c993
- SHA512
  
  90b322f47bde6ad80d4701d239fcae2d22ba5f430cc4c98a5294f0e4bc899ab5d34b000d2acf124a04e3654e1b0e962e1941d7418f478a921ddece72841f94ad
- SSDEEP
  
  49152:F/+nwLepp/O2r1+AFhHBGF5nX2nCTNcOCFinZ:owLK5O2oArhnCT6inZ
Score

10^/10

modiloader discovery evasion themida trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- Deletes itself
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoveryevasionthemidatrojan

behavioral2

discoveryevasionthemida

© 2018-2025

Terms | Privacy