modiloader | de8c127be32107c0d77ed2011a4ec8ad2513246ddd51a26f54374eed1b83bf35

General

Target

JaffaCakes118_7a293a3424fafdf4dff980409c703865
Size

484KB
Sample

250104-rng1qavqdj
MD5

7a293a3424fafdf4dff980409c703865
SHA1

80912b5bc9e0a3ef0c5f5722f6156cd94e84002e
SHA256

de8c127be32107c0d77ed2011a4ec8ad2513246ddd51a26f54374eed1b83bf35
SHA512

00907d6ac74be8c598ea213e2448156809a1c37c9486a5d7c2774d9e1ca5abc8d80a992438403e5e243da9add35c442503387dcdbd29374099b61e71521bca69
SSDEEP

12288:K7/yuwDwie0KSc47ekijPiv9JNXjEV8NXCCK/ot6K39xW:KGuwsie071z1XjEUCCEo069xW

Score

10^/10

Malware Config

Targets

- Target
  
  JaffaCakes118_7a293a3424fafdf4dff980409c703865
- Size
  
  484KB
- MD5
  
  7a293a3424fafdf4dff980409c703865
- SHA1
  
  80912b5bc9e0a3ef0c5f5722f6156cd94e84002e
- SHA256
  
  de8c127be32107c0d77ed2011a4ec8ad2513246ddd51a26f54374eed1b83bf35
- SHA512
  
  00907d6ac74be8c598ea213e2448156809a1c37c9486a5d7c2774d9e1ca5abc8d80a992438403e5e243da9add35c442503387dcdbd29374099b61e71521bca69
- SSDEEP
  
  12288:K7/yuwDwie0KSc47ekijPiv9JNXjEV8NXCCK/ot6K39xW:KGuwsie071z1XjEUCCEo069xW
Score

10^/10

modiloader discovery evasion execution persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Adds policy Run key to start application
  persistence
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2