modiloader | cbfc34b56f088d7ef00ee3b03c63a7e5762d73b3d9cdcb714e398e838b0e5fb0 | Triage

Sharing

General

Target

cbfc34b56f088d7ef00ee3b03c63a7e5762d73b3d9cdcb714e398e838b0e5fb0N.exe
Size

397KB
Sample

241202-htmzgsvkc1
MD5

cd1acdaefa3a80f509b14c9d664d1cd0
SHA1

1651add37426e92335c92f2cf2adc474ac46df78
SHA256

cbfc34b56f088d7ef00ee3b03c63a7e5762d73b3d9cdcb714e398e838b0e5fb0
SHA512

f678dc59e03e2acea56a37e5b43bff095000c3f5a518b3cd9ca0a817999893e01e005afea02d3f4bd6a54f78ed0620c51e4a16bef821d559a65b2e4bc1f62886
SSDEEP

6144:MLy84u9nSO2GjZkD10BIY3rb1YfBdfpoZ3u/Ht52w6JSeiFPXz47:Y+u9nx2GjMY3XKfd/H/9PM7

Score

10^/10

modiloader defense_evasion discovery persistence trojan

Malware Config

Targets

- Target
  
  cbfc34b56f088d7ef00ee3b03c63a7e5762d73b3d9cdcb714e398e838b0e5fb0N.exe
- Size
  
  397KB
- MD5
  
  cd1acdaefa3a80f509b14c9d664d1cd0
- SHA1
  
  1651add37426e92335c92f2cf2adc474ac46df78
- SHA256
  
  cbfc34b56f088d7ef00ee3b03c63a7e5762d73b3d9cdcb714e398e838b0e5fb0
- SHA512
  
  f678dc59e03e2acea56a37e5b43bff095000c3f5a518b3cd9ca0a817999893e01e005afea02d3f4bd6a54f78ed0620c51e4a16bef821d559a65b2e4bc1f62886
- SSDEEP
  
  6144:MLy84u9nSO2GjZkD10BIY3rb1YfBdfpoZ3u/Ht52w6JSeiFPXz47:Y+u9nx2GjMY3XKfd/H/9PM7
Score

10^/10

modiloader defense_evasion discovery persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

Safe Mode Boot

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdefense_evasiondiscoverypersistencetrojan

behavioral2

modiloaderdefense_evasiondiscoverypersistencetrojan