modiloader | 0ec6d1d92ab28d4c51093d763fbc421cd749bfbb238e7bd09cbad54abfe45d0a

General

Target

d023b9a1794027921c6f8b9dfc9afc49_JaffaCakes118
Size

171KB
Sample

241207-cfat4szkhy
MD5

d023b9a1794027921c6f8b9dfc9afc49
SHA1

fa0e8e3ec2933eae7e4b84ad3f57ba6e842e9f60
SHA256

0ec6d1d92ab28d4c51093d763fbc421cd749bfbb238e7bd09cbad54abfe45d0a
SHA512

96a9e8b82f588edce8b5d1b7c513883415e6e700b953261d76c7c28e218df5abf755dec2aba7625f48b8c96a8f5dcb1c881b25ae6d0eca8abc7f23d3ccbcd725
SSDEEP

3072:UZOcXlWZvIyoNJxmaKrQUdM24BOcXlWZvIyoNJxmaKrQUxM24:QOceOHx6rQDzOceOHx6rQv

Score

10^/10

Malware Config

Targets

- Target
  
  d023b9a1794027921c6f8b9dfc9afc49_JaffaCakes118
- Size
  
  171KB
- MD5
  
  d023b9a1794027921c6f8b9dfc9afc49
- SHA1
  
  fa0e8e3ec2933eae7e4b84ad3f57ba6e842e9f60
- SHA256
  
  0ec6d1d92ab28d4c51093d763fbc421cd749bfbb238e7bd09cbad54abfe45d0a
- SHA512
  
  96a9e8b82f588edce8b5d1b7c513883415e6e700b953261d76c7c28e218df5abf755dec2aba7625f48b8c96a8f5dcb1c881b25ae6d0eca8abc7f23d3ccbcd725
- SSDEEP
  
  3072:UZOcXlWZvIyoNJxmaKrQUdM24BOcXlWZvIyoNJxmaKrQUxM24:QOceOHx6rQDzOceOHx6rQv
Score

10^/10

modiloader discovery trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ModiLoader, DBatLoader

Modiloader family

ModiLoader Second Stage

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2