modiloader | c76a86eee658e3b0c9c43a986e78289d0479b531ef338ff4e125a38d49f650cf | Triage

Submit
Reports

Overview

overview

Static

static

JaffaCakes...fa.exe

windows7-x64

JaffaCakes...fa.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_96c1bdbbf1a770d8823c7255a68533fa
Size

249KB
Sample

250329-yrkdks1jz5
MD5

96c1bdbbf1a770d8823c7255a68533fa
SHA1

5187635da687b0ae196afe5ac7a4fc964e1d6c55
SHA256

c76a86eee658e3b0c9c43a986e78289d0479b531ef338ff4e125a38d49f650cf
SHA512

ae3497380f4c1cde53e2e24d70cbe80fe82e1f59bcf968d3a4e8c090da568767646bb771b7520c7671f3e60e279c0beab3fbdcf700ae57d0da19bbda0b93206d
SSDEEP

6144:XO739y72aD3BgFSBiobiciy4A0kCJ924GYdf:XwG5D3BgF8bXb0kC24dd

Score

10^/10

modiloader defense_evasion discovery trojan upx

Static task

static1

4 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_96c1bdbbf1a770d8823c7255a68533fa.exe

Resource

win7-20241010-en

modiloader defense_evasion discovery trojan upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_96c1bdbbf1a770d8823c7255a68533fa.exe

Resource

win10v2004-20250314-en

modiloader defense_evasion discovery trojan upx

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_96c1bdbbf1a770d8823c7255a68533fa
- Size
  
  249KB
- MD5
  
  96c1bdbbf1a770d8823c7255a68533fa
- SHA1
  
  5187635da687b0ae196afe5ac7a4fc964e1d6c55
- SHA256
  
  c76a86eee658e3b0c9c43a986e78289d0479b531ef338ff4e125a38d49f650cf
- SHA512
  
  ae3497380f4c1cde53e2e24d70cbe80fe82e1f59bcf968d3a4e8c090da568767646bb771b7520c7671f3e60e279c0beab3fbdcf700ae57d0da19bbda0b93206d
- SSDEEP
  
  6144:XO739y72aD3BgFSBiobiciy4A0kCJ924GYdf:XwG5D3BgF8bXb0kC24dd
Score

10^/10

modiloader defense_evasion discovery trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdefense_evasiondiscoverytrojanupx

behavioral2

modiloaderdefense_evasiondiscoverytrojanupx

© 2018-2025

Terms | Privacy