Extracted

• • Target

    https://github.com/enginestein/Virus-Collection/tree/main/Windows/Source

  Score

  10^/10

  modiloadernjratdefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modifies WinLogon for persistence

    persistence

  • Modiloader family

    modiloader

  • Njrat family

    njrat

  • UAC bypass

    evasiontrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • ModiLoader First Stage

  • Downloads MZ/PE file

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Modifies WinLogon

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1