modiloader | 0deaaf421fe0c7b03eb9d98114e6ac408eda9267e01153014586f3b3e7ecdd6f | Triage

Submit
Reports

Overview

overview

Static

static

3

80ba0f40b8...18.exe

windows7-x64

80ba0f40b8...18.exe

windows10-2004-x64

7

Sharing

General

Target

80ba0f40b85a10b9b2d486a2c43f45b7_JaffaCakes118
Size

2.7MB
Sample

241031-acx45avake
MD5

80ba0f40b85a10b9b2d486a2c43f45b7
SHA1

13e72cd328de13a232344ce372bc14248fd32eb8
SHA256

0deaaf421fe0c7b03eb9d98114e6ac408eda9267e01153014586f3b3e7ecdd6f
SHA512

1e254bef480bc91e5a5b6cc5e8de5d975120d563ff576586415b2971b0a1562011952788b0c731ba9993a078dc19f5182f660f1e782fe8de61611c7605a940a1
SSDEEP

49152:kjW2PSf6sJ2ehJ2guiUBYKdwYRGXEVMbqJ/r0/AJt8M:kjXP4J2LmUBuUGu0qJ/rd

Score

10^/10

modiloader discovery evasion trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

80ba0f40b85a10b9b2d486a2c43f45b7_JaffaCakes118.exe

Resource

win7-20241023-en

modiloader discovery evasion trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

80ba0f40b85a10b9b2d486a2c43f45b7_JaffaCakes118.exe

Resource

win10v2004-20241007-en

discovery evasion trojan

windows10-2004-x64

3 signatures

150 seconds

Malware Config

Targets

- Target
  
  80ba0f40b85a10b9b2d486a2c43f45b7_JaffaCakes118
- Size
  
  2.7MB
- MD5
  
  80ba0f40b85a10b9b2d486a2c43f45b7
- SHA1
  
  13e72cd328de13a232344ce372bc14248fd32eb8
- SHA256
  
  0deaaf421fe0c7b03eb9d98114e6ac408eda9267e01153014586f3b3e7ecdd6f
- SHA512
  
  1e254bef480bc91e5a5b6cc5e8de5d975120d563ff576586415b2971b0a1562011952788b0c731ba9993a078dc19f5182f660f1e782fe8de61611c7605a940a1
- SSDEEP
  
  49152:kjW2PSf6sJ2ehJ2guiUBYKdwYRGXEVMbqJ/r0/AJt8M:kjXP4J2LmUBuUGu0qJ/rd
Score

10^/10

modiloader discovery evasion trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoveryevasiontrojan

behavioral2

discoveryevasiontrojan

© 2018-2024

Terms | Privacy