modiloader | ee3e04171308b5c8fae57344a095285e83c10b942745f27f4696a01cd2b16678

Sharing

Copy URL

Twitter E-mail

General

Target

d3712f81b1dd98d78d99b0d639e64232_JaffaCakes118
Size

1.9MB
Sample

241207-y36e7a1qez
MD5

d3712f81b1dd98d78d99b0d639e64232
SHA1

49cc37c7d3971806c46b8ddc1427745244b4eb46
SHA256

ee3e04171308b5c8fae57344a095285e83c10b942745f27f4696a01cd2b16678
SHA512

fce9990bb534ecf58a748e707c40bc5a8f3e5cfa6769c6e1fc290a503ae573094013a7b6a38e88b3581453f5f6173d93ade21ad9c81631b379d5d65608531bc6
SSDEEP

49152:mGNHSoJZULvF8aUPbix/OA+wQ9UMZcUuuhJgHDppPWQVpbAaH9:ZSoJqTFMemwpMiU/EzuQjbB

Score

10^/10

Malware Config

Targets

- Target
  
  d3712f81b1dd98d78d99b0d639e64232_JaffaCakes118
- Size
  
  1.9MB
- MD5
  
  d3712f81b1dd98d78d99b0d639e64232
- SHA1
  
  49cc37c7d3971806c46b8ddc1427745244b4eb46
- SHA256
  
  ee3e04171308b5c8fae57344a095285e83c10b942745f27f4696a01cd2b16678
- SHA512
  
  fce9990bb534ecf58a748e707c40bc5a8f3e5cfa6769c6e1fc290a503ae573094013a7b6a38e88b3581453f5f6173d93ade21ad9c81631b379d5d65608531bc6
- SSDEEP
  
  49152:mGNHSoJZULvF8aUPbix/OA+wQ9UMZcUuuhJgHDppPWQVpbAaH9:ZSoJqTFMemwpMiU/EzuQjbB
Score

10^/10

modiloader bootkit discovery persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/NSISdl.dll
- Size
  
  72KB
- MD5
  
  b13935bfa7a3e43c112bd9fa02f08f28
- SHA1
  
  dec4f136057097c412f53c2ae41b80a8ad0c6810
- SHA256
  
  796f7efb91904fa4105528e18f6f87e3fdab9a070dabef83e02f9ae375b2b060
- SHA512
  
  1b92cde7bf74fc181b4d2602a269ef1f581b75eb67e3e46b256ddaddc153b95ee17d422a56ca04d68eafe61ab468b708f7f3691f3b47c554a67af00d49b2709a
- SSDEEP
  
  1536:Xq1go754oPtqTbIrKZYexTTvIUQt85rFmTwHoUgyX:Xqh14oPtjp6vIUQt85rboUgyX
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $TEMP/vaysoft-image-to-exe-converter-4.52.exe
- Size
  
  1.8MB
- MD5
  
  6ce9644cb6b649e61afaa8d79de40bf0
- SHA1
  
  a8b1ea2c5dd283fd7f889a58fb0dc087e4e2736a
- SHA256
  
  935225e6b0f68e3891f9d0f16f433a7673c5ecdc6a02fc8857bb1a6460492254
- SHA512
  
  e1db0d224de89a5a06bfc6ffc81320f5b20b2bff32ad4a61c0d70f607a6baafeadb6c33690c0246a2c84c129cfa0f4f8e3d72f5234414ef48dc615a722bd33c2
- SSDEEP
  
  49152:v2bno1q2wSvFPaBPpCiPRFbnPjTtwdxu5pUxHDp4ZW/VwbIaV:ubnoI29FIginHtExjhmM/Cb5
Score

10^/10

modiloader bootkit discovery persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral5 behavioral6
- Target
  
  $TEMP/windll.dll
- Size
  
  84KB
- MD5
  
  a20e8c18d8c26630407ca9a20dfe3ea9
- SHA1
  
  e5a28f8452144da79e09dfdff658a8ecb3c3e222
- SHA256
  
  8fe1124a3283b484243bf781c42b3361f7ad55c495f41e9b9868e719d3f1e497
- SHA512
  
  8475e142da0ec7ce5c9fb3b70e110e78670b3690f323cbfcfd5373dd954a8ca23c2d0e7d9a35befbccc5247d551a1bd9b92642a9d61018514a708fbc05fcaa0e
- SSDEEP
  
  1536:5blyFuzuyuFw1q3Hc96EBUdiTMKTg0gfxunQ9SIq7S6Eo1tRf0xHn:5blpzWzXc0kUmPMNZunQ9CH1tmx
Score

10^/10

discovery persistence
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- Loads dropped DLL
behavioral7 behavioral8