modiloader | 3bd22d97cd443fd8565bfbc9d4ae5b131ac6d592d1a61e86b4afaf57510ac10e | Triage

Submit
Reports

Overview

overview

Static

static

JaffaCakes...40.exe

windows7-x64

JaffaCakes...40.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_7a3a26934157613da67eb8cef0c59540
Size

271KB
Sample

250104-ryencatlcz
MD5

7a3a26934157613da67eb8cef0c59540
SHA1

a24ba88de0db9445ed16491badbed933c8765381
SHA256

3bd22d97cd443fd8565bfbc9d4ae5b131ac6d592d1a61e86b4afaf57510ac10e
SHA512

b59d2f93604a5881492a2ba38dd73e20517cc17e806465c10a8f41b8a910df0895120cbf996a5e1e182b29691a448374d888ca25a88a0d453207084a0820711c
SSDEEP

3072:UGvorw2wUTtDGDkovgYme1jZMjt7aEcbd8n8ORoMIpsefjwTBfsyqjAvvFmoz:UGyjnBSkuV1d4eZd88ORJIfrwTBtX3f

Score

10^/10

modiloader discovery evasion persistence trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_7a3a26934157613da67eb8cef0c59540.exe

Resource

win7-20240903-en

modiloader discovery evasion trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_7a3a26934157613da67eb8cef0c59540.exe

Resource

win10v2004-20241007-en

modiloader discovery evasion persistence trojan

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_7a3a26934157613da67eb8cef0c59540
- Size
  
  271KB
- MD5
  
  7a3a26934157613da67eb8cef0c59540
- SHA1
  
  a24ba88de0db9445ed16491badbed933c8765381
- SHA256
  
  3bd22d97cd443fd8565bfbc9d4ae5b131ac6d592d1a61e86b4afaf57510ac10e
- SHA512
  
  b59d2f93604a5881492a2ba38dd73e20517cc17e806465c10a8f41b8a910df0895120cbf996a5e1e182b29691a448374d888ca25a88a0d453207084a0820711c
- SSDEEP
  
  3072:UGvorw2wUTtDGDkovgYme1jZMjt7aEcbd8n8ORoMIpsefjwTBfsyqjAvvFmoz:UGyjnBSkuV1d4eZd88ORJIfrwTBtX3f
Score

10^/10

modiloader discovery evasion trojan persistence
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoveryevasiontrojan

behavioral2

modiloaderdiscoveryevasionpersistencetrojan

© 2018-2025

Terms | Privacy