modiloader | 634d6e0929dfcd35b88f7f3a6c3e525f327c5cc1c32590b1f84d86a9b4a8eec9 | Triage

Submit
Reports

Overview

overview

Static

static

5

JaffaCakes...82.exe

windows7-x64

JaffaCakes...82.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_0f1167737cae6aba59c0d3c24f801782
Size

274KB
Sample

250122-s441vstjfz
MD5

0f1167737cae6aba59c0d3c24f801782
SHA1

7fecab3145d2f76ce138803eecbbaa5b9d540a6d
SHA256

634d6e0929dfcd35b88f7f3a6c3e525f327c5cc1c32590b1f84d86a9b4a8eec9
SHA512

838efb5eee10f4694c7802355c991d351082e22f0cc69df8633fbce969c8c3dd9326862c17bc67847e4901eec23c9fe0f61f90bd130f5d54b3c25a51b0b1dcb0
SSDEEP

6144:J/cO/1D9tABPHJoNNSvUvN3jUHRPtNlD79/v6o6UyH:SO/Bb8HuDSvYzcPtNZ9/v6kyH

Score

10^/10

modiloader defense_evasion discovery persistence trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_0f1167737cae6aba59c0d3c24f801782.exe

Resource

win7-20240903-en

modiloader defense_evasion discovery persistence trojan upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_0f1167737cae6aba59c0d3c24f801782.exe

Resource

win10v2004-20241007-en

modiloader defense_evasion discovery persistence trojan upx

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_0f1167737cae6aba59c0d3c24f801782
- Size
  
  274KB
- MD5
  
  0f1167737cae6aba59c0d3c24f801782
- SHA1
  
  7fecab3145d2f76ce138803eecbbaa5b9d540a6d
- SHA256
  
  634d6e0929dfcd35b88f7f3a6c3e525f327c5cc1c32590b1f84d86a9b4a8eec9
- SHA512
  
  838efb5eee10f4694c7802355c991d351082e22f0cc69df8633fbce969c8c3dd9326862c17bc67847e4901eec23c9fe0f61f90bd130f5d54b3c25a51b0b1dcb0
- SSDEEP
  
  6144:J/cO/1D9tABPHJoNNSvUvN3jUHRPtNlD79/v6o6UyH:SO/Bb8HuDSvYzcPtNZ9/v6kyH
Score

10^/10

modiloader defense_evasion discovery persistence trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

Safe Mode Boot

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdefense_evasiondiscoverypersistencetrojanupx

behavioral2

modiloaderdefense_evasiondiscoverypersistencetrojanupx

© 2018-2025

Terms | Privacy