modiloader | c0799315f913f056a8c54b7b6588077ef19704bcb429da76a3c6f1513b421395 | Triage

Sharing

General

Target

c0799315f913f056a8c54b7b6588077ef19704bcb429da76a3c6f1513b421395
Size

397KB
Sample

241210-yrpnas1qfr
MD5

2eb721a96c0df7085051efcc1062f130
SHA1

6008e37ae60d34db9cabe184deb4c12c14fe3f54
SHA256

c0799315f913f056a8c54b7b6588077ef19704bcb429da76a3c6f1513b421395
SHA512

38a262e5e7d60a5acf56a65bc8c7ef5b4783cad13595077be733a86b692de5f7371b5889912e124fa41c06426da3417ad3b71751eefea5e6856ffdb58b985be1
SSDEEP

6144:cLy84u9nSO2GjZkD10BIY3rb1YfBdfpoZ3u/Ht52w6JSeiFPXV/P:I+u9nx2GjMY3XKfd/H/9P5P

Score

10^/10

modiloader defense_evasion discovery persistence trojan

Malware Config

Targets

- Target
  
  c0799315f913f056a8c54b7b6588077ef19704bcb429da76a3c6f1513b421395
- Size
  
  397KB
- MD5
  
  2eb721a96c0df7085051efcc1062f130
- SHA1
  
  6008e37ae60d34db9cabe184deb4c12c14fe3f54
- SHA256
  
  c0799315f913f056a8c54b7b6588077ef19704bcb429da76a3c6f1513b421395
- SHA512
  
  38a262e5e7d60a5acf56a65bc8c7ef5b4783cad13595077be733a86b692de5f7371b5889912e124fa41c06426da3417ad3b71751eefea5e6856ffdb58b985be1
- SSDEEP
  
  6144:cLy84u9nSO2GjZkD10BIY3rb1YfBdfpoZ3u/Ht52w6JSeiFPXV/P:I+u9nx2GjMY3XKfd/H/9P5P
Score

10^/10

modiloader defense_evasion discovery persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

Safe Mode Boot

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdefense_evasiondiscoverypersistencetrojan

behavioral2

modiloaderdefense_evasiondiscoverypersistencetrojan