modiloader | 0dd4533c13f81a64753d93761c355822824ea571a9b8109f9072170ad1b990c6 | Triage

Submit
Reports

Overview

overview

Static

static

3

JaffaCakes...15.exe

windows7-x64

7

JaffaCakes...15.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_95b73400d77e61cb689873f84d066115
Size

229KB
Sample

250329-ygzqhsxlv3
MD5

95b73400d77e61cb689873f84d066115
SHA1

541041c0c616bdff4fb0c92498cda6afd5397964
SHA256

0dd4533c13f81a64753d93761c355822824ea571a9b8109f9072170ad1b990c6
SHA512

743aa276e4d448011a60d08dbf615468b69fb4815dd9c961b54222e795b3bf2570f009983067f6a7a1c6fb38ce7d91c838d9c7b2e02f07a0a8ceb6fac8e40e4f
SSDEEP

3072:x4yDBrXb9YpZWhR2E5qHYO+PmfTQwIPSBGxpoykPcdTHBY+1l/qADuzAyi8GEzfR:xjDR5YpYR2KJ9aBC2PPITHlT/q9Ch

Score

10^/10

modiloader defense_evasion discovery trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_95b73400d77e61cb689873f84d066115.exe

Resource

win7-20240903-en

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_95b73400d77e61cb689873f84d066115.exe

Resource

win10v2004-20250314-en

modiloader defense_evasion discovery trojan upx

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_95b73400d77e61cb689873f84d066115
- Size
  
  229KB
- MD5
  
  95b73400d77e61cb689873f84d066115
- SHA1
  
  541041c0c616bdff4fb0c92498cda6afd5397964
- SHA256
  
  0dd4533c13f81a64753d93761c355822824ea571a9b8109f9072170ad1b990c6
- SHA512
  
  743aa276e4d448011a60d08dbf615468b69fb4815dd9c961b54222e795b3bf2570f009983067f6a7a1c6fb38ce7d91c838d9c7b2e02f07a0a8ceb6fac8e40e4f
- SSDEEP
  
  3072:x4yDBrXb9YpZWhR2E5qHYO+PmfTQwIPSBGxpoykPcdTHBY+1l/qADuzAyi8GEzfR:xjDR5YpYR2KJ9aBC2PPITHlT/q9Ch
Score

10^/10

discovery upx modiloader defense_evasion trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

modiloaderdefense_evasiondiscoverytrojanupx

© 2018-2025

Terms | Privacy