modiloader | ed3bae7c936380c0b0dedd62061362892a86d0fcadcbc0d530366ff2afd939a7 | Triage

Submit
Reports

Overview

overview

Static

static

3

fa7cee465d...18.exe

windows7-x64

fa7cee465d...18.exe

windows10-2004-x64

Sharing

General

Target

fa7cee465d0b4bd7504fe6c72a47b87d_JaffaCakes118
Size

596KB
Sample

241218-hettgsxnc1
MD5

fa7cee465d0b4bd7504fe6c72a47b87d
SHA1

f4fc8072ba19bc951b2cbae404c0feb0b8058c0d
SHA256

ed3bae7c936380c0b0dedd62061362892a86d0fcadcbc0d530366ff2afd939a7
SHA512

fba467df69cf5afd70efa826d46941d3bc29331366e60a066599d03eafd3e591cad4f250a1888ad950f08fccb64a6654b93108ffc72c851efcf34dec8ffb9f1d
SSDEEP

12288:Hd5lL52zyb4gqfjXCjpdkYWF3Z4mxxTDqVTVOClY:HVL+5rX7QmX6VTzlY

Score

10^/10

modiloader defense_evasion discovery persistence trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

fa7cee465d0b4bd7504fe6c72a47b87d_JaffaCakes118.exe

Resource

win7-20240903-en

modiloader defense_evasion discovery persistence trojan upx

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

fa7cee465d0b4bd7504fe6c72a47b87d_JaffaCakes118.exe

Resource

win10v2004-20241007-en

modiloader defense_evasion discovery persistence trojan upx

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  fa7cee465d0b4bd7504fe6c72a47b87d_JaffaCakes118
- Size
  
  596KB
- MD5
  
  fa7cee465d0b4bd7504fe6c72a47b87d
- SHA1
  
  f4fc8072ba19bc951b2cbae404c0feb0b8058c0d
- SHA256
  
  ed3bae7c936380c0b0dedd62061362892a86d0fcadcbc0d530366ff2afd939a7
- SHA512
  
  fba467df69cf5afd70efa826d46941d3bc29331366e60a066599d03eafd3e591cad4f250a1888ad950f08fccb64a6654b93108ffc72c851efcf34dec8ffb9f1d
- SSDEEP
  
  12288:Hd5lL52zyb4gqfjXCjpdkYWF3Z4mxxTDqVTVOClY:HVL+5rX7QmX6VTzlY
Score

10^/10

modiloader defense_evasion discovery persistence trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdefense_evasiondiscoverypersistencetrojanupx

behavioral2

modiloaderdefense_evasiondiscoverypersistencetrojanupx

© 2018-2024

Terms | Privacy