modiloader | 4727009fbe49ce250eda743e4ac5e4fc573c39b59ad9cc1cb065d2bdf31183ee | Triage

Submit
Reports

Overview

overview

Static

static

3

JaffaCakes...ce.exe

windows7-x64

JaffaCakes...ce.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_0e8967353e331a58e3f9e217deb296ce
Size

901KB
Sample

250122-rwfgvs1jb1
MD5

0e8967353e331a58e3f9e217deb296ce
SHA1

51fd5c08d51193b3175151e9cc905b2475ed0527
SHA256

4727009fbe49ce250eda743e4ac5e4fc573c39b59ad9cc1cb065d2bdf31183ee
SHA512

e344888bcb3d4756426b0793d330f40f60e5e096541ec325d9a1854f9efce5ff9a37d65e3590e0f9f8bfa0fdb1d0a681a2a6fc519b8bcac56b96fbff7df95e94
SSDEEP

12288:z1RgNhUulpvHGhW12Cyc8CwT5y3/oEqZ2McfmxeSYcdQ4RVHZOcMsbJ8cXovmXfW:HM+ujmCecB8cAfZJv3QSV+s9/4cn4f

Score

10^/10

modiloader bootkit discovery persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_0e8967353e331a58e3f9e217deb296ce.exe

Resource

win7-20241010-en

modiloader bootkit discovery persistence trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_0e8967353e331a58e3f9e217deb296ce.exe

Resource

win10v2004-20241007-en

modiloader bootkit discovery persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_0e8967353e331a58e3f9e217deb296ce
- Size
  
  901KB
- MD5
  
  0e8967353e331a58e3f9e217deb296ce
- SHA1
  
  51fd5c08d51193b3175151e9cc905b2475ed0527
- SHA256
  
  4727009fbe49ce250eda743e4ac5e4fc573c39b59ad9cc1cb065d2bdf31183ee
- SHA512
  
  e344888bcb3d4756426b0793d330f40f60e5e096541ec325d9a1854f9efce5ff9a37d65e3590e0f9f8bfa0fdb1d0a681a2a6fc519b8bcac56b96fbff7df95e94
- SSDEEP
  
  12288:z1RgNhUulpvHGhW12Cyc8CwT5y3/oEqZ2McfmxeSYcdQ4RVHZOcMsbJ8cXovmXfW:HM+ujmCecB8cAfZJv3QSV+s9/4cn4f
Score

10^/10

modiloader bootkit discovery persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderbootkitdiscoverypersistencetrojan

behavioral2

modiloaderbootkitdiscoverypersistencetrojan

© 2018-2025

Terms | Privacy