modiloader | 0990366ee10b0506d180d07d9277a0ffce5516077a6987462d0ab7dab81c9c54

General

Target

a8af083564e8b5ae625812744cfc3750_JaffaCakes118
Size

383KB
Sample

241127-tshtxsxkfl
MD5

a8af083564e8b5ae625812744cfc3750
SHA1

7dc45d40ecbba487ffe122d0c47b33b11ca43f5e
SHA256

0990366ee10b0506d180d07d9277a0ffce5516077a6987462d0ab7dab81c9c54
SHA512

5c64c4c1b02f96075901a6793876ebbe8d0bb7f27743af6856af26aa9cfdf97cc3e17b9ef63690de26f40fc07f55b88eff00a7a22ad47491f193f297a4bdef05
SSDEEP

6144:ccIIrR1D3aGc34y6OSPOaRZFE2eZfbSZ+apJq5LVTCSgT0:i61DJCXHS2aRZFExRbS8Iq5LVTC+

Score

10^/10

Malware Config

Targets

- Target
  
  a8af083564e8b5ae625812744cfc3750_JaffaCakes118
- Size
  
  383KB
- MD5
  
  a8af083564e8b5ae625812744cfc3750
- SHA1
  
  7dc45d40ecbba487ffe122d0c47b33b11ca43f5e
- SHA256
  
  0990366ee10b0506d180d07d9277a0ffce5516077a6987462d0ab7dab81c9c54
- SHA512
  
  5c64c4c1b02f96075901a6793876ebbe8d0bb7f27743af6856af26aa9cfdf97cc3e17b9ef63690de26f40fc07f55b88eff00a7a22ad47491f193f297a4bdef05
- SSDEEP
  
  6144:ccIIrR1D3aGc34y6OSPOaRZFE2eZfbSZ+apJq5LVTCSgT0:i61DJCXHS2aRZFExRbS8Iq5LVTC+
Score

10^/10

modiloader discovery trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ModiLoader, DBatLoader

Modiloader family

ModiLoader Second Stage

Deletes itself

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2