modiloader | 1a265c4e884e899665085de9a5068d99268728383fc2899b2a4bb4f92da2bd43 | Triage

Submit
Reports

Overview

overview

Static

static

3

c152a7ca06...18.exe

windows7-x64

c152a7ca06...18.exe

windows10-2004-x64

Sharing

General

Target

c152a7ca06a56fca2b7f1a13bf12341d_JaffaCakes118
Size

157KB
Sample

241204-hhwggswnbt
MD5

c152a7ca06a56fca2b7f1a13bf12341d
SHA1

ccf0b8dc16cb1327498b8b06b73b0d3a0d553074
SHA256

1a265c4e884e899665085de9a5068d99268728383fc2899b2a4bb4f92da2bd43
SHA512

ab53b91d7c7b4d049048c83ba1f9e5319b49a99c48e0a7e50c1119be783090149e333c27e2dadda0712deeb6c960bfccc2a5b5d3339bcf57cf03821b08ca5977
SSDEEP

3072:HbKH3VWqCJkENLA+mluQtzYiMFJM+od0p1qUlxPTWHp:70lWq0lGt8jFu+c0p1qUrap

Score

10^/10

modiloader defense_evasion discovery persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

c152a7ca06a56fca2b7f1a13bf12341d_JaffaCakes118.exe

Resource

win7-20240903-en

modiloader defense_evasion discovery persistence trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

c152a7ca06a56fca2b7f1a13bf12341d_JaffaCakes118.exe

Resource

win10v2004-20241007-en

modiloader defense_evasion discovery persistence trojan

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  c152a7ca06a56fca2b7f1a13bf12341d_JaffaCakes118
- Size
  
  157KB
- MD5
  
  c152a7ca06a56fca2b7f1a13bf12341d
- SHA1
  
  ccf0b8dc16cb1327498b8b06b73b0d3a0d553074
- SHA256
  
  1a265c4e884e899665085de9a5068d99268728383fc2899b2a4bb4f92da2bd43
- SHA512
  
  ab53b91d7c7b4d049048c83ba1f9e5319b49a99c48e0a7e50c1119be783090149e333c27e2dadda0712deeb6c960bfccc2a5b5d3339bcf57cf03821b08ca5977
- SSDEEP
  
  3072:HbKH3VWqCJkENLA+mluQtzYiMFJM+od0p1qUlxPTWHp:70lWq0lGt8jFu+c0p1qUrap
Score

10^/10

modiloader defense_evasion discovery persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Server Software Component: Terminal Services DLL
  persistence
- Deletes itself
- Loads dropped DLL
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

Terminal Services DLL

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdefense_evasiondiscoverypersistencetrojan

behavioral2

modiloaderdefense_evasiondiscoverypersistencetrojan

© 2018-2025

Terms | Privacy