modiloader | e22ff3e3b2e4b537eb3b5cdf9adf5e5c5278a630d8b90e6036260afe75d7bb65 | Triage

Sharing

General

Target

9402e6b26bd7f0b29be54c735dc66d0c_JaffaCakes118
Size

271KB
Sample

241124-l9p1ka1lfn
MD5

9402e6b26bd7f0b29be54c735dc66d0c
SHA1

736576829b40ae7f95681245777cb0cdec595b5a
SHA256

e22ff3e3b2e4b537eb3b5cdf9adf5e5c5278a630d8b90e6036260afe75d7bb65
SHA512

25218e7a5cc2ee16255f265fc826703c3ecde702ddd6c16dced5f12f2b83de5e366e289594ffd449a8ecb4cf51b65ce947bf2ce0d21b35118215ab4fb9389afd
SSDEEP

6144:TG377xS2Vp2Vp35A4nwTBAW753opcCJJvHo:ir7xS2Vpm3mswTaRbJJvHo

Score

10^/10

modiloader discovery evasion trojan

Malware Config

Targets

- Target
  
  9402e6b26bd7f0b29be54c735dc66d0c_JaffaCakes118
- Size
  
  271KB
- MD5
  
  9402e6b26bd7f0b29be54c735dc66d0c
- SHA1
  
  736576829b40ae7f95681245777cb0cdec595b5a
- SHA256
  
  e22ff3e3b2e4b537eb3b5cdf9adf5e5c5278a630d8b90e6036260afe75d7bb65
- SHA512
  
  25218e7a5cc2ee16255f265fc826703c3ecde702ddd6c16dced5f12f2b83de5e366e289594ffd449a8ecb4cf51b65ce947bf2ce0d21b35118215ab4fb9389afd
- SSDEEP
  
  6144:TG377xS2Vp2Vp35A4nwTBAW753opcCJJvHo:ir7xS2Vpm3mswTaRbJJvHo
Score

10^/10

modiloader discovery evasion trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- UAC bypass
  evasion trojan
- ModiLoader Second Stage
- Loads dropped DLL
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoveryevasiontrojan

behavioral2

modiloaderdiscoveryevasiontrojan