modiloader | bfd45eb54e16a0f2123d702a3462eadb80b1234b7302bdaa2033573f5443e8c2

General

Target

JaffaCakes118_99153e48e3fd16aa0c4228b79ad13ee4
Size

299KB
Sample

250330-yz3j5awtat
MD5

99153e48e3fd16aa0c4228b79ad13ee4
SHA1

f752ba94694f5fbddc7e1ca4e4751ec9be9b4136
SHA256

bfd45eb54e16a0f2123d702a3462eadb80b1234b7302bdaa2033573f5443e8c2
SHA512

06a0cc1cc6290a05b348a2366bfc648e639caff3a2ecf16d0b32c96642e29c373536b45bef8485300957091000e0f9fcb6ce44dd385fe199aa2204cf79bcf8fd
SSDEEP

6144:H8P4VXIg+h80vAVuhuF982YfBXAY9PzLA7pRUMBU54f6fyfiO0R+E:cQmg+v4VuhuF+BfKY9MRihqqbR+E

Score

10^/10

Malware Config

Targets

- Target
  
  JaffaCakes118_99153e48e3fd16aa0c4228b79ad13ee4
- Size
  
  299KB
- MD5
  
  99153e48e3fd16aa0c4228b79ad13ee4
- SHA1
  
  f752ba94694f5fbddc7e1ca4e4751ec9be9b4136
- SHA256
  
  bfd45eb54e16a0f2123d702a3462eadb80b1234b7302bdaa2033573f5443e8c2
- SHA512
  
  06a0cc1cc6290a05b348a2366bfc648e639caff3a2ecf16d0b32c96642e29c373536b45bef8485300957091000e0f9fcb6ce44dd385fe199aa2204cf79bcf8fd
- SSDEEP
  
  6144:H8P4VXIg+h80vAVuhuF982YfBXAY9PzLA7pRUMBU54f6fyfiO0R+E:cQmg+v4VuhuF+BfKY9MRihqqbR+E
Score

10^/10

modiloader discovery trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ModiLoader, DBatLoader

Modiloader family

ModiLoader Second Stage

Deletes itself

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2