modiloader | 40ab6fa51eff15e766399d0d6a48960708e3c382cb5e65184838a22b213c209c

General

Target

JaffaCakes118_6c8276aa406aad1f2f02706d98ab2b5a
Size

433KB
Sample

250103-pap33awjfk
MD5

6c8276aa406aad1f2f02706d98ab2b5a
SHA1

c62d46e3f99499d74ff07d5b41977d78fae9ad2d
SHA256

40ab6fa51eff15e766399d0d6a48960708e3c382cb5e65184838a22b213c209c
SHA512

48d9d95206f528ea405e67a2e68be7f5f291b2bd68fb5f17d0c295d270ed1a67fbf9ef484d1127f96636add47796ca78d6c89a89cc4623805f5886b7014660ec
SSDEEP

6144:GtU8o1I8vYJxuufZGTgBVZZlF1T3D16P1hWFlF320ONCC7h486I:GtUp1tvYJpfjvlF1TEP+lFvKh4W

Score

10^/10

Malware Config

Targets

- Target
  
  JaffaCakes118_6c8276aa406aad1f2f02706d98ab2b5a
- Size
  
  433KB
- MD5
  
  6c8276aa406aad1f2f02706d98ab2b5a
- SHA1
  
  c62d46e3f99499d74ff07d5b41977d78fae9ad2d
- SHA256
  
  40ab6fa51eff15e766399d0d6a48960708e3c382cb5e65184838a22b213c209c
- SHA512
  
  48d9d95206f528ea405e67a2e68be7f5f291b2bd68fb5f17d0c295d270ed1a67fbf9ef484d1127f96636add47796ca78d6c89a89cc4623805f5886b7014660ec
- SSDEEP
  
  6144:GtU8o1I8vYJxuufZGTgBVZZlF1T3D16P1hWFlF320ONCC7h486I:GtUp1tvYJpfjvlF1TEP+lFvKh4W
Score

10^/10

modiloader discovery evasion execution persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Adds policy Run key to start application
  persistence
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2