modiloader | 934981b509249b26ead3cea53770cc4cf062f8ddb3006cb8b52cbffe0a736f9e

General

Target

0035656d78ae0d0157e48d811db274a8_JaffaCakes118
Size

201KB
Sample

240930-jhz1caxgpf
MD5

0035656d78ae0d0157e48d811db274a8
SHA1

b7a111880537ae69776e76e245d66571445af5b6
SHA256

934981b509249b26ead3cea53770cc4cf062f8ddb3006cb8b52cbffe0a736f9e
SHA512

6bd149a14a6fd7f7007788a12246df60b2cb5604c584c128a535862f89e01b536b71cc352fb7e393dc10eb33d9bf5822c96141cdf1b139951540dc261dc92133
SSDEEP

3072:2VGPnyNZNUeumn0Vs1y7LCccgm3081pNpsM/WlqPzz90ijMVc+Scz9H:2V4yNZaeumn0VTcgmEopD3hE7PH

Score

10^/10

Malware Config

Targets

- Target
  
  0035656d78ae0d0157e48d811db274a8_JaffaCakes118
- Size
  
  201KB
- MD5
  
  0035656d78ae0d0157e48d811db274a8
- SHA1
  
  b7a111880537ae69776e76e245d66571445af5b6
- SHA256
  
  934981b509249b26ead3cea53770cc4cf062f8ddb3006cb8b52cbffe0a736f9e
- SHA512
  
  6bd149a14a6fd7f7007788a12246df60b2cb5604c584c128a535862f89e01b536b71cc352fb7e393dc10eb33d9bf5822c96141cdf1b139951540dc261dc92133
- SSDEEP
  
  3072:2VGPnyNZNUeumn0Vs1y7LCccgm3081pNpsM/WlqPzz90ijMVc+Scz9H:2V4yNZaeumn0VTcgmEopD3hE7PH
Score

10^/10

modiloader xorist credential_access defense_evasion discovery persistence ransomware spyware stealer trojan upx
- Detected Xorist Ransomware
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Xorist Ransomware
  Xorist is a ransomware first seen in 2020.
  ransomware xorist
- ModiLoader Second Stage
- Renames multiple (2209) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2