modiloader | cd970cc2e7e418c0eb4210af6150db6d359b3a13b8288e3bc540053fe3f664cf

General

Target

JaffaCakes118_6accaaa04099b9c11084a6281921caf7
Size

585KB
Sample

250103-ha293avrej
MD5

6accaaa04099b9c11084a6281921caf7
SHA1

bcb1741eebbe8ef48985bcf779488fd2d6bf758e
SHA256

cd970cc2e7e418c0eb4210af6150db6d359b3a13b8288e3bc540053fe3f664cf
SHA512

302b754535a7936f5341b351efe7e59a404bc0eec6a5b6c5c174e5fe968babf6b8d2bcbc57b2617a49a71d30cf37fa518c50a2f65afc849040781cc169c92edf
SSDEEP

12288:LWrs10oi/sgvqzH7cZtnAwyiokT9yJC2h/7biHTQrMXv9iECnggbazWTn6xsagm+:LWrs+/sgOcvnpyiJCC2hTG2MkECngg4A

Score

10^/10

Malware Config

Targets

- Target
  
  JaffaCakes118_6accaaa04099b9c11084a6281921caf7
- Size
  
  585KB
- MD5
  
  6accaaa04099b9c11084a6281921caf7
- SHA1
  
  bcb1741eebbe8ef48985bcf779488fd2d6bf758e
- SHA256
  
  cd970cc2e7e418c0eb4210af6150db6d359b3a13b8288e3bc540053fe3f664cf
- SHA512
  
  302b754535a7936f5341b351efe7e59a404bc0eec6a5b6c5c174e5fe968babf6b8d2bcbc57b2617a49a71d30cf37fa518c50a2f65afc849040781cc169c92edf
- SSDEEP
  
  12288:LWrs10oi/sgvqzH7cZtnAwyiokT9yJC2h/7biHTQrMXv9iECnggbazWTn6xsagm+:LWrs+/sgOcvnpyiJCC2hTG2MkECngg4A
Score

10^/10

modiloader discovery evasion execution persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Adds policy Run key to start application
  persistence
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2