modiloader | 7b41e9bf814faf836e660aab8db4d578f8e1e47d9da11b5cfc32efa61f22f059

General

Target

e7a786c8643a844e2d69cf658d966bd5_JaffaCakes118
Size

501KB
Sample

241212-wt8g3svjdq
MD5

e7a786c8643a844e2d69cf658d966bd5
SHA1

a98ce54a952e86789ce289d704b5f4620ca7f635
SHA256

7b41e9bf814faf836e660aab8db4d578f8e1e47d9da11b5cfc32efa61f22f059
SHA512

5e8108032a287cebf724c229fac3b2c1b0abcce210097cb7a37e21cad2638aef9e65adaa2514cccb54efb9e2733c05335ba4ce67173af1a6fe102437352dad67
SSDEEP

6144:9qer9lZxBXpvW0WB8ZZWgRCDOQ3CkQnFkkr1R0MQsMCV4gMfowNSsr+YD5J+h1Lo:9qu9vXpvW0UMtRCDDy3lr4fk2Zf2XLmJ

Score

10^/10

Malware Config

Targets

- Target
  
  e7a786c8643a844e2d69cf658d966bd5_JaffaCakes118
- Size
  
  501KB
- MD5
  
  e7a786c8643a844e2d69cf658d966bd5
- SHA1
  
  a98ce54a952e86789ce289d704b5f4620ca7f635
- SHA256
  
  7b41e9bf814faf836e660aab8db4d578f8e1e47d9da11b5cfc32efa61f22f059
- SHA512
  
  5e8108032a287cebf724c229fac3b2c1b0abcce210097cb7a37e21cad2638aef9e65adaa2514cccb54efb9e2733c05335ba4ce67173af1a6fe102437352dad67
- SSDEEP
  
  6144:9qer9lZxBXpvW0WB8ZZWgRCDOQ3CkQnFkkr1R0MQsMCV4gMfowNSsr+YD5J+h1Lo:9qu9vXpvW0UMtRCDDy3lr4fk2Zf2XLmJ
Score

10^/10

modiloader discovery evasion execution persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Adds policy Run key to start application
  persistence
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2