modiloader | d93ebe63a4955070bcf43eb5bd096951954e4965a6e64e1a5f5c6837221cda76 | Triage

Submit
Reports

Overview

overview

Static

static

7

970fdd86cc...18.exe

windows7-x64

970fdd86cc...18.exe

windows10-2004-x64

3

Sharing

General

Target

970fdd86ccacc153b497c4f19cbe8f54_JaffaCakes118
Size

1.3MB
Sample

241124-zbjmsayjez
MD5

970fdd86ccacc153b497c4f19cbe8f54
SHA1

f8f23667c8b8258620f1f67118ea68339b75958e
SHA256

d93ebe63a4955070bcf43eb5bd096951954e4965a6e64e1a5f5c6837221cda76
SHA512

7a1fb2724328125be627d8bc9e685f93144b1f7c0a4e0138dc5b1e9cb7d4a4f11a58b60b50d71679e0470d0afc9b6eebfda4d3e33e52cb024df6495ca30a4489
SSDEEP

24576:3h0t0fgQSwA84eHTINk9qT9JxFXVFXDTQEahtPeXzuOnm7Be:ut0fiwAwRolrkEgPqXN

Score

10^/10

modiloader discovery evasion themida trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

970fdd86ccacc153b497c4f19cbe8f54_JaffaCakes118.exe

Resource

win7-20240903-en

modiloader discovery evasion themida trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

970fdd86ccacc153b497c4f19cbe8f54_JaffaCakes118.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Malware Config

Targets

- Target
  
  970fdd86ccacc153b497c4f19cbe8f54_JaffaCakes118
- Size
  
  1.3MB
- MD5
  
  970fdd86ccacc153b497c4f19cbe8f54
- SHA1
  
  f8f23667c8b8258620f1f67118ea68339b75958e
- SHA256
  
  d93ebe63a4955070bcf43eb5bd096951954e4965a6e64e1a5f5c6837221cda76
- SHA512
  
  7a1fb2724328125be627d8bc9e685f93144b1f7c0a4e0138dc5b1e9cb7d4a4f11a58b60b50d71679e0470d0afc9b6eebfda4d3e33e52cb024df6495ca30a4489
- SSDEEP
  
  24576:3h0t0fgQSwA84eHTINk9qT9JxFXVFXDTQEahtPeXzuOnm7Be:ut0fiwAwRolrkEgPqXN
Score

10^/10

modiloader discovery evasion themida trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- UAC bypass
  evasion trojan
- ModiLoader Second Stage
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoveryevasionthemidatrojan

behavioral2

© 2018-2024

Terms | Privacy