modiloader | 9593c66ac9c17251d1f8e6aff6a46bfd177315b81e683f623c430c8d3bf20d09 | Triage

Submit
Reports

Overview

overview

Static

static

3

JaffaCakes...4b.exe

windows7-x64

JaffaCakes...4b.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_0c3a8ee34fa6f3d4dcb2edff7b87d64b
Size

220KB
Sample

250122-k4dvnsynby
MD5

0c3a8ee34fa6f3d4dcb2edff7b87d64b
SHA1

cd21dd2fec404c0f7badc796b92a545a39eb428c
SHA256

9593c66ac9c17251d1f8e6aff6a46bfd177315b81e683f623c430c8d3bf20d09
SHA512

a2e523ec2f07b2a448e4764e8c8215a258939dfdf8cca36b8ba4d27fcd66cfaea6d9bbc4f9a47cc4ed9a6f0b5b16450bdfc6e566feee535170d5cb09861a2ed3
SSDEEP

3072:sSSSC0dxo9SdRC0D4ccYWLo51dW201hw6JjP3Pjpl8ePRzJTW0KWUS8EQWX:DDES/CsWud7irFtlRPR95KWuj

Score

10^/10

modiloader defense_evasion discovery persistence trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_0c3a8ee34fa6f3d4dcb2edff7b87d64b.exe

Resource

win7-20241010-en

modiloader defense_evasion discovery persistence trojan upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_0c3a8ee34fa6f3d4dcb2edff7b87d64b.exe

Resource

win10v2004-20241007-en

modiloader defense_evasion discovery persistence trojan upx

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_0c3a8ee34fa6f3d4dcb2edff7b87d64b
- Size
  
  220KB
- MD5
  
  0c3a8ee34fa6f3d4dcb2edff7b87d64b
- SHA1
  
  cd21dd2fec404c0f7badc796b92a545a39eb428c
- SHA256
  
  9593c66ac9c17251d1f8e6aff6a46bfd177315b81e683f623c430c8d3bf20d09
- SHA512
  
  a2e523ec2f07b2a448e4764e8c8215a258939dfdf8cca36b8ba4d27fcd66cfaea6d9bbc4f9a47cc4ed9a6f0b5b16450bdfc6e566feee535170d5cb09861a2ed3
- SSDEEP
  
  3072:sSSSC0dxo9SdRC0D4ccYWLo51dW201hw6JjP3Pjpl8ePRzJTW0KWUS8EQWX:DDES/CsWud7irFtlRPR95KWuj
Score

10^/10

modiloader defense_evasion discovery persistence trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

Safe Mode Boot

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdefense_evasiondiscoverypersistencetrojanupx

behavioral2

modiloaderdefense_evasiondiscoverypersistencetrojanupx

© 2018-2025

Terms | Privacy