modiloader | de5fd8b358ed919565e70ddbff245f2ff67055babc0d6a0a66763d3bd1067a89

General

Target

JaffaCakes118_6b2c83f4f0201db5c3b1eac9d107f2c4
Size

431KB
Sample

250103-jm7kzsvkb1
MD5

6b2c83f4f0201db5c3b1eac9d107f2c4
SHA1

6f3636b7102f267af7983fb012e8870290429081
SHA256

de5fd8b358ed919565e70ddbff245f2ff67055babc0d6a0a66763d3bd1067a89
SHA512

08cd87b021074b24241bc8ee378f4b271159417b7cba1a615cb643946fa8cb8731c628131a5500b13a521ab084d9270b96a864fb78f8b67ce46ab64bb1919b98
SSDEEP

12288:wmBk8jykeRcOvEhgzxjWy3TCB+ML5s4BCw:ww6vEhAxr3TA1mw

Score

10^/10

Malware Config

Targets

- Target
  
  JaffaCakes118_6b2c83f4f0201db5c3b1eac9d107f2c4
- Size
  
  431KB
- MD5
  
  6b2c83f4f0201db5c3b1eac9d107f2c4
- SHA1
  
  6f3636b7102f267af7983fb012e8870290429081
- SHA256
  
  de5fd8b358ed919565e70ddbff245f2ff67055babc0d6a0a66763d3bd1067a89
- SHA512
  
  08cd87b021074b24241bc8ee378f4b271159417b7cba1a615cb643946fa8cb8731c628131a5500b13a521ab084d9270b96a864fb78f8b67ce46ab64bb1919b98
- SSDEEP
  
  12288:wmBk8jykeRcOvEhgzxjWy3TCB+ML5s4BCw:ww6vEhAxr3TA1mw
Score

10^/10

modiloader discovery evasion execution persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Adds policy Run key to start application
  persistence
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2