modiloader | db1671d940ff26da7359a4b6c51652e38678433c3a6c643f98456ea8c8e32a91 | Triage

Sharing

General

Target

d5f0a26589f19e0da4bcdb020b489527_JaffaCakes118
Size

93KB
Sample

241208-jffhxsxlgx
MD5

d5f0a26589f19e0da4bcdb020b489527
SHA1

e36263362f33e8777556bea0cdf458d8bd48a2f2
SHA256

db1671d940ff26da7359a4b6c51652e38678433c3a6c643f98456ea8c8e32a91
SHA512

db1809680b4b79d874bc67cc4f44ef86ca9861e9f0f30213994276dbb460ae61d73828ee361de900a029a5a6217b3eead0327e6b79088d8e2b55fd4ab41d217b
SSDEEP

1536:szqeYQ4AjB/QkNLnmgJIu++O5mFCIpNnv5/lmdX4ET4VeKGms1JceVKXMIN9WRPY:SY1AV/pMgI5Ipdv3+o04VeKGB1+jXTNh

Score

10^/10

modiloader discovery evasion trojan

Malware Config

Targets

- Target
  
  d5f0a26589f19e0da4bcdb020b489527_JaffaCakes118
- Size
  
  93KB
- MD5
  
  d5f0a26589f19e0da4bcdb020b489527
- SHA1
  
  e36263362f33e8777556bea0cdf458d8bd48a2f2
- SHA256
  
  db1671d940ff26da7359a4b6c51652e38678433c3a6c643f98456ea8c8e32a91
- SHA512
  
  db1809680b4b79d874bc67cc4f44ef86ca9861e9f0f30213994276dbb460ae61d73828ee361de900a029a5a6217b3eead0327e6b79088d8e2b55fd4ab41d217b
- SSDEEP
  
  1536:szqeYQ4AjB/QkNLnmgJIu++O5mFCIpNnv5/lmdX4ET4VeKGms1JceVKXMIN9WRPY:SY1AV/pMgI5Ipdv3+o04VeKGB1+jXTNh
Score

10^/10

modiloader discovery evasion trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modifies firewall policy service
  evasion
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoveryevasiontrojan

behavioral2

modiloaderdiscoveryevasiontrojan