modiloader | ed131301a469a80bbf5365317dd00fdae80b54d2e8039a39ee8dfc3d3a1ff5a5 | Triage

Submit
Reports

Overview

overview

Static

static

3

9524fca16d...18.exe

windows7-x64

9524fca16d...18.exe

windows10-2004-x64

Sharing

General

Target

9524fca16d2814c953d15de5e0cc9473_JaffaCakes118
Size

117KB
Sample

241124-rdxcnaspgt
MD5

9524fca16d2814c953d15de5e0cc9473
SHA1

6068582eafe4a0ef19993c22171fbe9859de172a
SHA256

ed131301a469a80bbf5365317dd00fdae80b54d2e8039a39ee8dfc3d3a1ff5a5
SHA512

b7b888e3510fa35d3c6b94ad2d8295a17627549519a6f1a51e84898e65c7af2f6cc73312b7e30d35060e3ca0aa6d1004ff2f551ab37094bf95754e346d9d9103
SSDEEP

3072:a9tz39ULS/mysYKaJCDx3nS/ByyRaga0nZxEBg:a9tztULS/mH3hyRazYxEG

Score

10^/10

modiloader discovery evasion trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

9524fca16d2814c953d15de5e0cc9473_JaffaCakes118.exe

Resource

win7-20240903-en

modiloader discovery evasion trojan upx

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

9524fca16d2814c953d15de5e0cc9473_JaffaCakes118.exe

Resource

win10v2004-20241007-en

modiloader discovery evasion trojan upx

windows10-2004-x64

18 signatures

150 seconds

Malware Config

Targets

- Target
  
  9524fca16d2814c953d15de5e0cc9473_JaffaCakes118
- Size
  
  117KB
- MD5
  
  9524fca16d2814c953d15de5e0cc9473
- SHA1
  
  6068582eafe4a0ef19993c22171fbe9859de172a
- SHA256
  
  ed131301a469a80bbf5365317dd00fdae80b54d2e8039a39ee8dfc3d3a1ff5a5
- SHA512
  
  b7b888e3510fa35d3c6b94ad2d8295a17627549519a6f1a51e84898e65c7af2f6cc73312b7e30d35060e3ca0aa6d1004ff2f551ab37094bf95754e346d9d9103
- SSDEEP
  
  3072:a9tz39ULS/mysYKaJCDx3nS/ByyRaga0nZxEBg:a9tztULS/mH3hyRazYxEG
Score

10^/10

modiloader discovery evasion trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- UAC bypass
  evasion trojan
- ModiLoader Second Stage
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoveryevasiontrojanupx

behavioral2

modiloaderdiscoveryevasiontrojanupx

© 2018-2025

Terms | Privacy