modiloader | 153df0b62b32abea05a68d9f9bdb1d0ceadd5fe04dd1334b7d6053afb67309fe

General

Target

153df0b62b32abea05a68d9f9bdb1d0ceadd5fe04dd1334b7d6053afb67309feN.exe
Size

912KB
Sample

241125-syeh1stlcx
MD5

0564ba769d20df8f127c1f491e6a5540
SHA1

f4c47f8fd8a402bdd5c05aff882b1dace1633186
SHA256

153df0b62b32abea05a68d9f9bdb1d0ceadd5fe04dd1334b7d6053afb67309fe
SHA512

e6b3a837db38293ed6a4cca20af53a2cb0387af61945e9fdcf78da3ba2a8ffa47172ddff1fcf262d23812dc72205bd32156c46215d46a88525986f1afa317fee
SSDEEP

24576:ETzSqlFYcq/ZgmvTZ06L5+JYmm2gackH:ELTCvvt0g4JYNazH

Score

10^/10

Malware Config

Targets

- Target
  
  153df0b62b32abea05a68d9f9bdb1d0ceadd5fe04dd1334b7d6053afb67309feN.exe
- Size
  
  912KB
- MD5
  
  0564ba769d20df8f127c1f491e6a5540
- SHA1
  
  f4c47f8fd8a402bdd5c05aff882b1dace1633186
- SHA256
  
  153df0b62b32abea05a68d9f9bdb1d0ceadd5fe04dd1334b7d6053afb67309fe
- SHA512
  
  e6b3a837db38293ed6a4cca20af53a2cb0387af61945e9fdcf78da3ba2a8ffa47172ddff1fcf262d23812dc72205bd32156c46215d46a88525986f1afa317fee
- SSDEEP
  
  24576:ETzSqlFYcq/ZgmvTZ06L5+JYmm2gackH:ELTCvvt0g4JYNazH
Score

10^/10

modiloader bootkit discovery persistence trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2