modiloader | e6270fb29a04bd2a667875b4d9af9dfac0634dcd90c651a63dc42c078b2bad56

General

Target

e7d5e6dde646af391da17c485861ee5e_JaffaCakes118
Size

75KB
Sample

241212-xr5tvatqaz
MD5

e7d5e6dde646af391da17c485861ee5e
SHA1

c22f3b657943cc5bf6191c5816d568d2885918e8
SHA256

e6270fb29a04bd2a667875b4d9af9dfac0634dcd90c651a63dc42c078b2bad56
SHA512

e2c72e37113b545541fb9867a67eb7cd8031634f0949f2e0cdc6754924864244ece9f45fca2e6e628cd0fe594b3065d858b7e706d066655ba710a93e17feff00
SSDEEP

1536:xTg2nOVaPv6mgBxuc1uaJ260KmW/eSqXigpbSdu8:Jg2nOV4fgBP1r5/eSQr8du8

Score

10^/10

Malware Config

Targets

- Target
  
  e7d5e6dde646af391da17c485861ee5e_JaffaCakes118
- Size
  
  75KB
- MD5
  
  e7d5e6dde646af391da17c485861ee5e
- SHA1
  
  c22f3b657943cc5bf6191c5816d568d2885918e8
- SHA256
  
  e6270fb29a04bd2a667875b4d9af9dfac0634dcd90c651a63dc42c078b2bad56
- SHA512
  
  e2c72e37113b545541fb9867a67eb7cd8031634f0949f2e0cdc6754924864244ece9f45fca2e6e628cd0fe594b3065d858b7e706d066655ba710a93e17feff00
- SSDEEP
  
  1536:xTg2nOVaPv6mgBxuc1uaJ260KmW/eSqXigpbSdu8:Jg2nOV4fgBP1r5/eSQr8du8
Score

10^/10

modiloader adware discovery stealer trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ModiLoader, DBatLoader

Modiloader family

ModiLoader Second Stage

Installs/modifies Browser Helper Object

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2