modiloader | 1ee6c7af00dd0c328999cea0ea44060de70e473ef4548729205f81007c557c51 | Triage

Submit
Reports

Overview

overview

Static

static

8ea4f8cce4...18.exe

windows7-x64

8ea4f8cce4...18.exe

windows10-2004-x64

Sharing

General

Target

8ea4f8cce42d4de1f99542fd6be8d8bb_JaffaCakes118
Size

27KB
Sample

241104-cpbg1azmfs
MD5

8ea4f8cce42d4de1f99542fd6be8d8bb
SHA1

fc58e58246a5f0bd482289e9c90c8d59b5bec777
SHA256

1ee6c7af00dd0c328999cea0ea44060de70e473ef4548729205f81007c557c51
SHA512

debc353a04dd16b1b5ce90476e8830bd05f235659aeb104ac4563bd0e517121028df8717930173126adf74d2c9928ca1c33edd8c0be6efc80f42fbf2887ee08c
SSDEEP

384:t9mRSCF82EkoaoP6qhNyp/XFzbL9pfjwJRWVLnptepi1GqyT0ERCoui/:t4RzS2r5oPjhNyp/htpOELG+EEoui/

Score

10^/10

modiloader discovery persistence trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

8ea4f8cce42d4de1f99542fd6be8d8bb_JaffaCakes118.exe

Resource

win7-20240903-en

modiloader discovery persistence trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

8ea4f8cce42d4de1f99542fd6be8d8bb_JaffaCakes118.exe

Resource

win10v2004-20241007-en

modiloader discovery trojan

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  8ea4f8cce42d4de1f99542fd6be8d8bb_JaffaCakes118
- Size
  
  27KB
- MD5
  
  8ea4f8cce42d4de1f99542fd6be8d8bb
- SHA1
  
  fc58e58246a5f0bd482289e9c90c8d59b5bec777
- SHA256
  
  1ee6c7af00dd0c328999cea0ea44060de70e473ef4548729205f81007c557c51
- SHA512
  
  debc353a04dd16b1b5ce90476e8830bd05f235659aeb104ac4563bd0e517121028df8717930173126adf74d2c9928ca1c33edd8c0be6efc80f42fbf2887ee08c
- SSDEEP
  
  384:t9mRSCF82EkoaoP6qhNyp/XFzbL9pfjwJRWVLnptepi1GqyT0ERCoui/:t4RzS2r5oPjhNyp/htpOELG+EEoui/
Score

10^/10

modiloader discovery persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoverypersistencetrojan

behavioral2

modiloaderdiscoverytrojan

© 2018-2024

Terms | Privacy