modiloader | aeaa0a82b77e6f9be47dfae6b87b4e6c7113fcdc9c433bb5e9ebec9613318d8d | Triage

Submit
Reports

Overview

overview

Static

static

JaffaCakes...08.exe

windows7-x64

JaffaCakes...08.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_02834ca1ee7a3899bef818f98236ad08
Size

294KB
Sample

250121-gr18nazlbn
MD5

02834ca1ee7a3899bef818f98236ad08
SHA1

93e8504fe754afba08e0d6124456f4e5cab6d12e
SHA256

aeaa0a82b77e6f9be47dfae6b87b4e6c7113fcdc9c433bb5e9ebec9613318d8d
SHA512

706f297ef89824c3e4012b117cb6e81bcba3daeb16beca6639b34e4a226c20ecdcb4482ed5a25f2dc1bd500c75f9adf8af65423f57c86b6d119bdf34581b3964
SSDEEP

6144:l4hJQM/KsXoMDGWmV9Jw9DY7yQue0VkIcYRHoO3iQjv4YGKSKud5Bx6MmdL0:lQJQIldSNqlYCequOICQ65+QM3

Score

10^/10

modiloader discovery trojan upx

Static task

static1

4 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_02834ca1ee7a3899bef818f98236ad08.exe

Resource

win7-20240903-en

modiloader discovery trojan upx

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_02834ca1ee7a3899bef818f98236ad08.exe

Resource

win10v2004-20241007-en

modiloader discovery trojan upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_02834ca1ee7a3899bef818f98236ad08
- Size
  
  294KB
- MD5
  
  02834ca1ee7a3899bef818f98236ad08
- SHA1
  
  93e8504fe754afba08e0d6124456f4e5cab6d12e
- SHA256
  
  aeaa0a82b77e6f9be47dfae6b87b4e6c7113fcdc9c433bb5e9ebec9613318d8d
- SHA512
  
  706f297ef89824c3e4012b117cb6e81bcba3daeb16beca6639b34e4a226c20ecdcb4482ed5a25f2dc1bd500c75f9adf8af65423f57c86b6d119bdf34581b3964
- SSDEEP
  
  6144:l4hJQM/KsXoMDGWmV9Jw9DY7yQue0VkIcYRHoO3iQjv4YGKSKud5Bx6MmdL0:lQJQIldSNqlYCequOICQ65+QM3
Score

10^/10

modiloader discovery trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoverytrojanupx

behavioral2

modiloaderdiscoverytrojanupx

© 2018-2025

Terms | Privacy