modiloader | 0784bfb3bd9bde694b7d60c40bf253d6288c8d95eff4d43fbb6777b1519f1432 | Triage

Sharing

General

Target

0784bfb3bd9bde694b7d60c40bf253d6288c8d95eff4d43fbb6777b1519f1432.exe
Size

397KB
Sample

250106-1wdgya1qfm
MD5

695d8061b62be9cd530aa71313bf319d
SHA1

9acbc31f02c9f5e5f02f329b14e2cb94ff9bfab0
SHA256

0784bfb3bd9bde694b7d60c40bf253d6288c8d95eff4d43fbb6777b1519f1432
SHA512

cb9997b41e157a5c10e6fa46fac3a976ab807ade8b6485d26309344c999e0d16150adb45b666529aa36ed02646cd54a5c697f1b6c498a0881e091d36eee11a4a
SSDEEP

6144:BLy84u9nSO2GjZkD10BIY3rb1YfBdfpoZ3u/Ht52w6JWP3oa:J+u9nx2GjMY3XKfd/H/9Ya

Score

10^/10

modiloader defense_evasion discovery persistence trojan

Malware Config

Targets

- Target
  
  0784bfb3bd9bde694b7d60c40bf253d6288c8d95eff4d43fbb6777b1519f1432.exe
- Size
  
  397KB
- MD5
  
  695d8061b62be9cd530aa71313bf319d
- SHA1
  
  9acbc31f02c9f5e5f02f329b14e2cb94ff9bfab0
- SHA256
  
  0784bfb3bd9bde694b7d60c40bf253d6288c8d95eff4d43fbb6777b1519f1432
- SHA512
  
  cb9997b41e157a5c10e6fa46fac3a976ab807ade8b6485d26309344c999e0d16150adb45b666529aa36ed02646cd54a5c697f1b6c498a0881e091d36eee11a4a
- SSDEEP
  
  6144:BLy84u9nSO2GjZkD10BIY3rb1YfBdfpoZ3u/Ht52w6JWP3oa:J+u9nx2GjMY3XKfd/H/9Ya
Score

10^/10

modiloader defense_evasion discovery persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

Safe Mode Boot

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdefense_evasiondiscoverypersistencetrojan

behavioral2

modiloaderdefense_evasiondiscoverypersistencetrojan