modiloader | 624dcc5a9acd3a3e8bbfcf41748d0f3960fd2d78b33bff7269ef31e067204584 | Triage

Submit
Reports

Overview

overview

Static

static

3

c353b8b358...18.exe

windows7-x64

c353b8b358...18.exe

windows10-2004-x64

Sharing

General

Target

c353b8b3584e3eaca5b55da90b8cf893_JaffaCakes118
Size

411KB
Sample

241204-tlkpyazrdw
MD5

c353b8b3584e3eaca5b55da90b8cf893
SHA1

3b05a6b51744f34404a87193eab71151edc82a96
SHA256

624dcc5a9acd3a3e8bbfcf41748d0f3960fd2d78b33bff7269ef31e067204584
SHA512

d468eb0d1ed8c3d82a5a927c18d6e5926b8b2fd874a275305cbe751b2a0fc045471064ae0b114f212b127ab5610f31efbe41a6640c3cf9ac777201f9c0db031b
SSDEEP

6144:FqcG4gVzj3Bq26w1cMWBK3kvkcMPLnByki/Rs+3M4KVF+iEZVPTvMhjJIotGGgxa:q4gh3I2JcpK3k8c0ykY73MjVcOhNl

Score

10^/10

modiloader discovery persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

c353b8b3584e3eaca5b55da90b8cf893_JaffaCakes118.exe

Resource

win7-20241010-en

modiloader discovery persistence trojan

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

c353b8b3584e3eaca5b55da90b8cf893_JaffaCakes118.exe

Resource

win10v2004-20241007-en

modiloader discovery persistence trojan

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  c353b8b3584e3eaca5b55da90b8cf893_JaffaCakes118
- Size
  
  411KB
- MD5
  
  c353b8b3584e3eaca5b55da90b8cf893
- SHA1
  
  3b05a6b51744f34404a87193eab71151edc82a96
- SHA256
  
  624dcc5a9acd3a3e8bbfcf41748d0f3960fd2d78b33bff7269ef31e067204584
- SHA512
  
  d468eb0d1ed8c3d82a5a927c18d6e5926b8b2fd874a275305cbe751b2a0fc045471064ae0b114f212b127ab5610f31efbe41a6640c3cf9ac777201f9c0db031b
- SSDEEP
  
  6144:FqcG4gVzj3Bq26w1cMWBK3kvkcMPLnByki/Rs+3M4KVF+iEZVPTvMhjJIotGGgxa:q4gh3I2JcpK3k8c0ykY73MjVcOhNl
Score

10^/10

modiloader discovery persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoverypersistencetrojan

behavioral2

modiloaderdiscoverypersistencetrojan

© 2018-2025

Terms | Privacy