modiloader | d8e8c6c9b6f7241fa53a6ee9c7ceb0c5b8914608c49b5de154755a8af252229b | Triage

Submit
Reports

Overview

overview

Static

static

3

f0277a027c...18.exe

windows7-x64

f0277a027c...18.exe

windows10-2004-x64

7

Sharing

General

Target

f0277a027c4e4d174b2cf996e526f77a_JaffaCakes118
Size

1.1MB
Sample

241214-xcb8zssmhm
MD5

f0277a027c4e4d174b2cf996e526f77a
SHA1

fc9203736c162d4f940af4f7f82b28a9020f2e5d
SHA256

d8e8c6c9b6f7241fa53a6ee9c7ceb0c5b8914608c49b5de154755a8af252229b
SHA512

1e88bad8ad513d8a3cc3cd9e800e6de63458d260fcbfcbb0bfedcc251bb2b3762b731b63e098ba93c6ad22dea13a3f8543faff3d65628a111d96e5a396cc8385
SSDEEP

24576:N67T4oQm/5Rvy4w7U+wYItAxOqC8+d4vJzT7RJ1deXkWhe:NSQ7ULeOv8ymFXTgkQe

Score

10^/10

modiloader discovery evasion trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

f0277a027c4e4d174b2cf996e526f77a_JaffaCakes118.exe

Resource

win7-20240903-en

modiloader discovery evasion trojan

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

f0277a027c4e4d174b2cf996e526f77a_JaffaCakes118.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  f0277a027c4e4d174b2cf996e526f77a_JaffaCakes118
- Size
  
  1.1MB
- MD5
  
  f0277a027c4e4d174b2cf996e526f77a
- SHA1
  
  fc9203736c162d4f940af4f7f82b28a9020f2e5d
- SHA256
  
  d8e8c6c9b6f7241fa53a6ee9c7ceb0c5b8914608c49b5de154755a8af252229b
- SHA512
  
  1e88bad8ad513d8a3cc3cd9e800e6de63458d260fcbfcbb0bfedcc251bb2b3762b731b63e098ba93c6ad22dea13a3f8543faff3d65628a111d96e5a396cc8385
- SSDEEP
  
  24576:N67T4oQm/5Rvy4w7U+wYItAxOqC8+d4vJzT7RJ1deXkWhe:NSQ7ULeOv8ymFXTgkQe
Score

10^/10

modiloader discovery evasion trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoveryevasiontrojan

behavioral2

© 2018-2025

Terms | Privacy