modiloader | 7651a407f1fdb28af4ec98c8cc4869a2709905c8b35311e4366fb4f097326277 | Triage

Submit
Reports

Overview

overview

Static

static

3

7651a407f1...77.exe

windows7-x64

7651a407f1...77.exe

windows10-2004-x64

Sharing

General

Target

7651a407f1fdb28af4ec98c8cc4869a2709905c8b35311e4366fb4f097326277
Size

1.1MB
Sample

241117-mtqslaxmhv
MD5

ddeaf624a268748a32e4794bef5ea28f
SHA1

2a9b0dd759c01158c697b5edf301a00574ce2abc
SHA256

7651a407f1fdb28af4ec98c8cc4869a2709905c8b35311e4366fb4f097326277
SHA512

910b3a7462aef715359d13be1e6f50fb05f165bb916b9002cd93d9b0a28d04a8976b45fdea2faad20b885a4fa1d5ba8076d18d65ba218f63314084d7699dc288
SSDEEP

24576:rCtVqnbUQ25Qm2Xz8iYcx3RqrPBzKRfuHpEqiyu5T5:rkabmQYc3qrWyuv

Score

10^/10

modiloader discovery persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

7651a407f1fdb28af4ec98c8cc4869a2709905c8b35311e4366fb4f097326277.exe

Resource

win7-20240903-en

modiloader discovery persistence trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

7651a407f1fdb28af4ec98c8cc4869a2709905c8b35311e4366fb4f097326277.exe

Resource

win10v2004-20241007-en

modiloader discovery persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  7651a407f1fdb28af4ec98c8cc4869a2709905c8b35311e4366fb4f097326277
- Size
  
  1.1MB
- MD5
  
  ddeaf624a268748a32e4794bef5ea28f
- SHA1
  
  2a9b0dd759c01158c697b5edf301a00574ce2abc
- SHA256
  
  7651a407f1fdb28af4ec98c8cc4869a2709905c8b35311e4366fb4f097326277
- SHA512
  
  910b3a7462aef715359d13be1e6f50fb05f165bb916b9002cd93d9b0a28d04a8976b45fdea2faad20b885a4fa1d5ba8076d18d65ba218f63314084d7699dc288
- SSDEEP
  
  24576:rCtVqnbUQ25Qm2Xz8iYcx3RqrPBzKRfuHpEqiyu5T5:rkabmQYc3qrWyuv
Score

10^/10

modiloader discovery persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoverypersistencetrojan

behavioral2

modiloaderdiscoverypersistencetrojan

© 2018-2024

Terms | Privacy