modiloader | 88c547758660fde76610c2de5dc9352a74b3cc699dd8518fe19596b4ed8c4329

General

Target

JaffaCakes118_459eab3f8d57e9390562c080095fcaae
Size

519KB
Sample

250101-d3csnatjds
MD5

459eab3f8d57e9390562c080095fcaae
SHA1

3c500a574fdf8bddd4a083788fd24b02eacd241d
SHA256

88c547758660fde76610c2de5dc9352a74b3cc699dd8518fe19596b4ed8c4329
SHA512

438c23c52639cefcc3bc9438fa52f337585c6ecc38bc80d15f6e9fffa30f59a394d3bc322e8e3cbb40bf706a8932261e4c1aa355b177eadec02b473465ed84ae
SSDEEP

12288:+DAA46NWxzdfL19YLl84rkdJ45sWT6AlTCVTthwaRo:+DgxhfLsgda/GsGtab

Score

10^/10

Malware Config

Targets

- Target
  
  JaffaCakes118_459eab3f8d57e9390562c080095fcaae
- Size
  
  519KB
- MD5
  
  459eab3f8d57e9390562c080095fcaae
- SHA1
  
  3c500a574fdf8bddd4a083788fd24b02eacd241d
- SHA256
  
  88c547758660fde76610c2de5dc9352a74b3cc699dd8518fe19596b4ed8c4329
- SHA512
  
  438c23c52639cefcc3bc9438fa52f337585c6ecc38bc80d15f6e9fffa30f59a394d3bc322e8e3cbb40bf706a8932261e4c1aa355b177eadec02b473465ed84ae
- SSDEEP
  
  12288:+DAA46NWxzdfL19YLl84rkdJ45sWT6AlTCVTthwaRo:+DgxhfLsgda/GsGtab
Score

10^/10

modiloader discovery evasion execution persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Adds policy Run key to start application
  persistence
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2