modiloader | 9be83a22321aae449837d4ed462bc7b09dac25a052379b33b3d369921353c438 | Triage

Sharing

General

Target

055407d5b5c7bc1544a9d5fd8e0e1357_JaffaCakes118
Size

2.1MB
Sample

241001-ltk2nsshnl
MD5

055407d5b5c7bc1544a9d5fd8e0e1357
SHA1

127889e86ee604ef10a4f386ad18e18c856b6a26
SHA256

9be83a22321aae449837d4ed462bc7b09dac25a052379b33b3d369921353c438
SHA512

170dc98f2ca7c71686dbbdd2e5745e53d0aa02f8c2e0d6d1143f2c9dc1d4c52917998b1b8dd5dc8091d977a1d30b890bc139b840a9a054c47808a433ae9941fe
SSDEEP

49152:ToG2+5Fx0y5OqpwwryqEyLJ7P+MuM3g5329:Z3x0gwwrPltr+ZfG9

Score

10^/10

modiloader discovery trojan

Malware Config

Targets

- Target
  
  055407d5b5c7bc1544a9d5fd8e0e1357_JaffaCakes118
- Size
  
  2.1MB
- MD5
  
  055407d5b5c7bc1544a9d5fd8e0e1357
- SHA1
  
  127889e86ee604ef10a4f386ad18e18c856b6a26
- SHA256
  
  9be83a22321aae449837d4ed462bc7b09dac25a052379b33b3d369921353c438
- SHA512
  
  170dc98f2ca7c71686dbbdd2e5745e53d0aa02f8c2e0d6d1143f2c9dc1d4c52917998b1b8dd5dc8091d977a1d30b890bc139b840a9a054c47808a433ae9941fe
- SSDEEP
  
  49152:ToG2+5Fx0y5OqpwwryqEyLJ7P+MuM3g5329:Z3x0gwwrPltr+ZfG9
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/Base64.dll
- Size
  
  4KB
- MD5
  
  f0e3845fefd227d7f1101850410ec849
- SHA1
  
  3067203fafd4237be0c186ddab7029dfcbdfb53e
- SHA256
  
  7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554
- SHA512
  
  584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a
- SSDEEP
  
  48:SxSrr7xd14m4bLKwvnvcfDw1hEiauGkDVK+hIg4qT9/3lt:zr7xd14m4qw/vGwrEickDVthcE/
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/BrandingURL.dll
- Size
  
  4KB
- MD5
  
  71c46b663baa92ad941388d082af97e7
- SHA1
  
  5a9fcce065366a526d75cc5ded9aade7cadd6421
- SHA256
  
  bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
- SHA512
  
  5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  0dc0cc7a6d9db685bf05a7e5f3ea4781
- SHA1
  
  5d8b6268eeec9d8d904bc9d988a4b588b392213f
- SHA256
  
  8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
- SHA512
  
  814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
- SSDEEP
  
  192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  00a0194c20ee912257df53bfe258ee4a
- SHA1
  
  d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA256
  
  dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- SHA512
  
  3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/blowfish.dll
- Size
  
  22KB
- MD5
  
  5afd4a9b7e69e7c6e312b2ce4040394a
- SHA1
  
  fbd07adb3f02f866dc3a327a86b0f319d4a94502
- SHA256
  
  053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae
- SHA512
  
  f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511
- SSDEEP
  
  384:yTxz0Cv0hqd+1TjQmd9YWrSUEc//////OD5hF92IJpJgLa0MpoYfAz6S:jCvsqdS3QGBREc//////Q53NgLa1ub
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/inetc.dll
- Size
  
  20KB
- MD5
  
  50fdadda3e993688401f6f1108fabdb4
- SHA1
  
  04a9ae55d0fb726be49809582cea41d75bf22a9a
- SHA256
  
  6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
- SHA512
  
  e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
- SSDEEP
  
  384:jQB2ZUVHUxgoJX0eBA6PcH85db+ya9cC0Ac9khYLMkIX0+G5xgZmT+m//a:j/UFeJ5S6PHLNa9cFam/
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  Flash.ocx
- Size
  
  917KB
- MD5
  
  fc3e17e12c2e31fac34b416b3dab829f
- SHA1
  
  ca33d1fa3d27c67c8bf2503a7474ac4f9223ed49
- SHA256
  
  471643ea9df42cc168412f33720f5b8cb1b391555cc795a5313224565274e9c0
- SHA512
  
  01a35672f70fcec69136475fab9ed643364af1683d49cb07cf6e5e47f003e2b8d0a553c52c42222c9ab7be4014f4e31a4701d30e28acd3c92a5407af4cc9a4fe
- SSDEEP
  
  24576:VvGzbaRNTt7tM7n0Nxt4oqN2eD65QmPNwJLKkn3WfhZXp:xmsxtJQn0Tt4rK5QmPNw4knGJpp
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  libavidd-1.3.1.dll
- Size
  
  28KB
- MD5
  
  2243e6d6652c06f40bd002128c35a957
- SHA1
  
  0029a797d363656ced0b0ead36baf00b2241c01f
- SHA256
  
  6436f04f508b2c3940c9efd556755880845312025fa0079b5019661bb8c03f6c
- SHA512
  
  0f08874eb2ec6c6544620c465e7b84a16812c8de93159df5b413afa9d3921b9f6c7dceb580fe4c76fc4500b1956e4504b0a46b64b98bc1ba13540cf545be384e
- SSDEEP
  
  192:1UDNYUwVUpkZwgWumGjUNUF4v91tQtKqpqSqq5kfQ2wqpqSqqcE:12YUOhaOU+y91tQt5ASZ5kfQ2jASZcE
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  libfilefmt-1.4.2.dll
- Size
  
  3.2MB
- MD5
  
  4ef7dc56c95514fc007ce8247203aa5c
- SHA1
  
  5680df3204bf4e9058c55b4054ccb1bd8e091160
- SHA256
  
  9d7ff72fa4589851d3af26f2c1f4fa68bb542eaf0ae91c685ec82974be59d561
- SHA512
  
  5a45d90a487686d83b3a7713b7e1c0ba8f7d1ee0ae4e3a017e66eab16ed80055c73eadbbc0883ef507bdeef392db1831e495289c45b1f49e47e3d0fddfd86a99
- SSDEEP
  
  49152:1E0/U85JPvTGb/1aGCQ6I0F/mPSWZc+bvzE4b6fTAy9SFl7OIiHaz4Z:1E0/U85R7Gb/10FEVGTAy9kiHaz4Z
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  
  libmcl-4.2.0.dll
- Size
  
  786KB
- MD5
  
  9e62356dc137da505bdadf5d84b2d6ed
- SHA1
  
  53768c382aabe5a09b164790f613fc820114d2c8
- SHA256
  
  5452bc5cbace35311ffebcf246f5e3aec5641508843b7914daba2b8e8392f3a8
- SHA512
  
  82a2ccfdd276a78b9b8450bdfee84f252b324ca35258068621dfbdb0dda59e6d77f16727a1540148f68ef676f50a22a43bb55d0f0235c3eafb8b93df479c88a1
- SSDEEP
  
  12288:Rf7FWWQRiX20VNYAcWhdRwbZyxqfmegCL3JtH0:t7FYMX2yN0Wh52megCLZtH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  
  swftovideo.exe
- Size
  
  396KB
- MD5
  
  a239d8e8ac1fe229894f4af8f3d442d9
- SHA1
  
  3995b475b42f819fc493aed13e74069b3e920221
- SHA256
  
  4e72e858c8959351d585728b07ae012f03f0d8d893e84c9b205a8c887891b63b
- SHA512
  
  ff9bf3fcdc3ef41b5e96188cb1716f77cb369e2e1e9d08cba7345f1ad2dd9ff399c68be5ea47cd2f40ebe24778ad188e1ff99c302b55bcda7a5abe602ed7345f
- SSDEEP
  
  6144:AYxLVHPt4JfyYuwz6Wf2ReJnwka1BnuHkhaPQzYeojaoFhvsD/XEF588zEI6k:R9Pt4J6nwzlByjuHk4Ypo/nUD/0FX1
Score

10^/10

modiloader discovery trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
behavioral23 behavioral24
- Target
  
  uninst.exe
- Size
  
  58KB
- MD5
  
  cbc28fc391e93383281b779f417fdf43
- SHA1
  
  b2f8134842b15db2c74f4c0337678b6cd1da5fd6
- SHA256
  
  5a2bda57dea74c2cd75a66ec8e168dba3f498a7d6c9a9d06c8c7b2c6aba5bb0c
- SHA512
  
  2a614cbf0fbf23b79dadf7b48af157c94a3327a166edfcb7e61238b786c6693b66b4ae3ab98c7e7b04145d42625103dad449d3999583da26f68e773e69216506
- SSDEEP
  
  1536:/QpQ5EP0ijnRTXJk2n2AznO0Ucs8c33sFlXi:/QIURTXJk2PO0nS3ii
Score

7^/10

discovery
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral25 behavioral26

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

modiloaderdiscoverytrojan

behavioral24

modiloaderdiscoverytrojan

behavioral25

behavioral26