modiloader | 31ddf76a482627ed6a16f2032e997ddc79621dd58de747ca2a1f5f730b8a1668

General

Target

0098a6f7ff6d4fec1dd68c5490a832c6_JaffaCakes118
Size

363KB
Sample

240930-ldk2qsxdrp
MD5

0098a6f7ff6d4fec1dd68c5490a832c6
SHA1

df77f212a2015b9bf7f731731bf97c2a3e9ff325
SHA256

31ddf76a482627ed6a16f2032e997ddc79621dd58de747ca2a1f5f730b8a1668
SHA512

ce80d0baf8270b0ef5e68c85e36881c82475a7756590b7e8191f3890480508b4d7374eee9a950b4b7dbd653fd56e959ea50bcaf0eb98b66a2ded97469df8fcb1
SSDEEP

6144:0e2N0dOCGzogTKULqOxmdK4ylktToPHVuIQHQeq2zhF9vCzsXZokGE:0e2N0drW3THLHmI4gkG9u5HTZZL

Score

10^/10

Malware Config

Targets

- Target
  
  0098a6f7ff6d4fec1dd68c5490a832c6_JaffaCakes118
- Size
  
  363KB
- MD5
  
  0098a6f7ff6d4fec1dd68c5490a832c6
- SHA1
  
  df77f212a2015b9bf7f731731bf97c2a3e9ff325
- SHA256
  
  31ddf76a482627ed6a16f2032e997ddc79621dd58de747ca2a1f5f730b8a1668
- SHA512
  
  ce80d0baf8270b0ef5e68c85e36881c82475a7756590b7e8191f3890480508b4d7374eee9a950b4b7dbd653fd56e959ea50bcaf0eb98b66a2ded97469df8fcb1
- SSDEEP
  
  6144:0e2N0dOCGzogTKULqOxmdK4ylktToPHVuIQHQeq2zhF9vCzsXZokGE:0e2N0drW3THLHmI4gkG9u5HTZZL
Score

10^/10

modiloader discovery evasion execution persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2