modiloader | ef0b2ced7f4e8f68b0b29b30704c113f6faa2e6696022c47dd9d2d7fb2aa58d1 | Triage

Submit
Reports

Overview

overview

Static

static

f0f3012229...18.exe

windows7-x64

f0f3012229...18.exe

windows10-2004-x64

Sharing

General

Target

f0f301222997fcc0afb66a22c582fc4d_JaffaCakes118
Size

210KB
Sample

241214-14ysvaxnhm
MD5

f0f301222997fcc0afb66a22c582fc4d
SHA1

463084af7d4e17ee02575baf2a7969619902e216
SHA256

ef0b2ced7f4e8f68b0b29b30704c113f6faa2e6696022c47dd9d2d7fb2aa58d1
SHA512

810727f3c8f6130f5d5ffb3ff85df550cd3f078c3a0644acd7180f3caa46dccaca0625fc51fc91063a095e782206f9519a8fdeff87699056cb3350adae1d5f95
SSDEEP

3072:MGbHwx3GsAFyQbXO0kwXmFRqAh+7QouCv8BATTy+zL9GwqRlcBapeEdmIMyXLx7v:MG7u6jrkwvKaXR0cyYLF6lcBapBdd6F

Score

10^/10

modiloader defense_evasion discovery persistence trojan upx

Static task

static1

4 signatures

Behavioral task

behavioral1

Sample

f0f301222997fcc0afb66a22c582fc4d_JaffaCakes118.exe

Resource

win7-20240903-en

modiloader defense_evasion discovery persistence trojan upx

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

f0f301222997fcc0afb66a22c582fc4d_JaffaCakes118.exe

Resource

win10v2004-20241007-en

modiloader defense_evasion discovery persistence trojan upx

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  f0f301222997fcc0afb66a22c582fc4d_JaffaCakes118
- Size
  
  210KB
- MD5
  
  f0f301222997fcc0afb66a22c582fc4d
- SHA1
  
  463084af7d4e17ee02575baf2a7969619902e216
- SHA256
  
  ef0b2ced7f4e8f68b0b29b30704c113f6faa2e6696022c47dd9d2d7fb2aa58d1
- SHA512
  
  810727f3c8f6130f5d5ffb3ff85df550cd3f078c3a0644acd7180f3caa46dccaca0625fc51fc91063a095e782206f9519a8fdeff87699056cb3350adae1d5f95
- SSDEEP
  
  3072:MGbHwx3GsAFyQbXO0kwXmFRqAh+7QouCv8BATTy+zL9GwqRlcBapeEdmIMyXLx7v:MG7u6jrkwvKaXR0cyYLF6lcBapBdd6F
Score

10^/10

modiloader defense_evasion discovery persistence trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

Safe Mode Boot

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdefense_evasiondiscoverypersistencetrojanupx

behavioral2

modiloaderdefense_evasiondiscoverypersistencetrojanupx

© 2018-2025

Terms | Privacy