modiloader | a8e6946c98d209d6b4cb045d3409f19cc068aca19d89d9986d604c4397d0dec4 | Triage

Sharing

General

Target

nixware.exe
Size

397KB
Sample

250218-lcgb6azr18
MD5

81b78a9441f6f04876687d2038adf13a
SHA1

f29918f12093bddd3046cd54750b79967e1ac8bd
SHA256

a8e6946c98d209d6b4cb045d3409f19cc068aca19d89d9986d604c4397d0dec4
SHA512

809603a8674d06c12667e4fe174913de5a12758a80afcaba6d2487c39ee870549b5384e1685955cfbc90a5e32848408dbcb35a7a9595f16459991f2852664465
SSDEEP

6144:cLy84u9nSO2GjZkD10BIY3rb1YfBdfpoZ3u/Ht52w6JSeiFPXoJP:I+u9nx2GjMY3XKfd/H/9PoP

Score

10^/10

modiloader defense_evasion discovery persistence

Malware Config

Targets

- Target
  
  nixware.exe
- Size
  
  397KB
- MD5
  
  81b78a9441f6f04876687d2038adf13a
- SHA1
  
  f29918f12093bddd3046cd54750b79967e1ac8bd
- SHA256
  
  a8e6946c98d209d6b4cb045d3409f19cc068aca19d89d9986d604c4397d0dec4
- SHA512
  
  809603a8674d06c12667e4fe174913de5a12758a80afcaba6d2487c39ee870549b5384e1685955cfbc90a5e32848408dbcb35a7a9595f16459991f2852664465
- SSDEEP
  
  6144:cLy84u9nSO2GjZkD10BIY3rb1YfBdfpoZ3u/Ht52w6JSeiFPXoJP:I+u9nx2GjMY3XKfd/H/9PoP
Score

7^/10

defense_evasion discovery persistence
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

Safe Mode Boot

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistence