modiloader | 6d0193e7f1069a3b4639a6406590e8515f1a3d03d4a43a0d21756666d54e37de

General

Target

JaffaCakes118_60429f8190360a3b6c895d2d0c87bddd
Size

330KB
Sample

250101-x88xtsznew
MD5

60429f8190360a3b6c895d2d0c87bddd
SHA1

ee9a358af5a68d5a398df819122503e19b136de0
SHA256

6d0193e7f1069a3b4639a6406590e8515f1a3d03d4a43a0d21756666d54e37de
SHA512

ceaa2c3ecaf4a16ad56b5dff85a71db5a809d04962da77d6f798ef52f35e75bf7074b1b184ada09641f74cc091da841df44f811482ff769fb963960805ad5079
SSDEEP

6144:qkG3Sd5/QqsXzSIN8GQH29HcohpgaqZK9zHGQ7DXQccckz:ECnsOCZhraQ7D4z

Score

10^/10

Malware Config

Targets

- Target
  
  JaffaCakes118_60429f8190360a3b6c895d2d0c87bddd
- Size
  
  330KB
- MD5
  
  60429f8190360a3b6c895d2d0c87bddd
- SHA1
  
  ee9a358af5a68d5a398df819122503e19b136de0
- SHA256
  
  6d0193e7f1069a3b4639a6406590e8515f1a3d03d4a43a0d21756666d54e37de
- SHA512
  
  ceaa2c3ecaf4a16ad56b5dff85a71db5a809d04962da77d6f798ef52f35e75bf7074b1b184ada09641f74cc091da841df44f811482ff769fb963960805ad5079
- SSDEEP
  
  6144:qkG3Sd5/QqsXzSIN8GQH29HcohpgaqZK9zHGQ7DXQccckz:ECnsOCZhraQ7D4z
Score

10^/10

modiloader discovery evasion execution persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Adds policy Run key to start application
  persistence
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2