modiloader | 1a2aebdc8ea489ca50ef8c97cfa173e82c7256260653e64b70f3b1d20daa536f

General

Target

JaffaCakes118_200f4265cdfafc4e8a58b9a43cd3b1c5
Size

184KB
Sample

250113-edb1hatrew
MD5

200f4265cdfafc4e8a58b9a43cd3b1c5
SHA1

0fc35ec376bff900da402a63e694e77df94602ee
SHA256

1a2aebdc8ea489ca50ef8c97cfa173e82c7256260653e64b70f3b1d20daa536f
SHA512

c1dd823682a79df6a3758c5f127d304f7fd221fb5ed35ee05436227563272e60785b5736eb8a6b291fb76dcd4336bd2f5866d2ea67e88ce4cf541a90aff193d5
SSDEEP

3072:NTy+3kYEajtqC2k9JBFbUhb6NwWjAXrPY3ih5i+fMyWETqWxCB7iDI5ZQYGtBNRB:NTt3kYEOtqC2aJBFbUhb6NwWjArv7LMO

Score

10^/10

Malware Config

Targets

- Target
  
  JaffaCakes118_200f4265cdfafc4e8a58b9a43cd3b1c5
- Size
  
  184KB
- MD5
  
  200f4265cdfafc4e8a58b9a43cd3b1c5
- SHA1
  
  0fc35ec376bff900da402a63e694e77df94602ee
- SHA256
  
  1a2aebdc8ea489ca50ef8c97cfa173e82c7256260653e64b70f3b1d20daa536f
- SHA512
  
  c1dd823682a79df6a3758c5f127d304f7fd221fb5ed35ee05436227563272e60785b5736eb8a6b291fb76dcd4336bd2f5866d2ea67e88ce4cf541a90aff193d5
- SSDEEP
  
  3072:NTy+3kYEajtqC2k9JBFbUhb6NwWjAXrPY3ih5i+fMyWETqWxCB7iDI5ZQYGtBNRB:NTt3kYEOtqC2aJBFbUhb6NwWjArv7LMO
Score

10^/10

modiloader discovery evasion trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Executes dropped EXE
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ModiLoader, DBatLoader

Modiloader family

ModiLoader Second Stage

Executes dropped EXE

Checks whether UAC is enabled

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2