modiloader | 477c74758b4c59334fcdb2051089efbe191d2cda4252aecea59b13bb93bfb101

General

Target

dbe2d1c015b38f317ec1f5f0f5305a7c_JaffaCakes118
Size

407KB
Sample

241209-2vda8ayrfl
MD5

dbe2d1c015b38f317ec1f5f0f5305a7c
SHA1

b257f02adb58fd7a99c9f6c1de85f5388541f18e
SHA256

477c74758b4c59334fcdb2051089efbe191d2cda4252aecea59b13bb93bfb101
SHA512

b8c7c0686a09c84d5e6b2999362b700320a54b9a65766a5a7930f81d19d2e67579280bdad71db7ffbe819edb83a2129954d54689e0801c8d3cf78739defd961b
SSDEEP

6144:/BemJ2TYhimZQWM3Ac7zfW2geZToVBkjM+jcBCvvU83FLOV3bDOz6ABivpPFl:/B0T2imZEQcX+2g0ToVBIcIvvU8dudJZ

Score

10^/10

Malware Config

Targets

- Target
  
  dbe2d1c015b38f317ec1f5f0f5305a7c_JaffaCakes118
- Size
  
  407KB
- MD5
  
  dbe2d1c015b38f317ec1f5f0f5305a7c
- SHA1
  
  b257f02adb58fd7a99c9f6c1de85f5388541f18e
- SHA256
  
  477c74758b4c59334fcdb2051089efbe191d2cda4252aecea59b13bb93bfb101
- SHA512
  
  b8c7c0686a09c84d5e6b2999362b700320a54b9a65766a5a7930f81d19d2e67579280bdad71db7ffbe819edb83a2129954d54689e0801c8d3cf78739defd961b
- SSDEEP
  
  6144:/BemJ2TYhimZQWM3Ac7zfW2geZToVBkjM+jcBCvvU83FLOV3bDOz6ABivpPFl:/B0T2imZEQcX+2g0ToVBIcIvvU8dudJZ
Score

10^/10

modiloader discovery evasion execution persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Drops startup file
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2