modiloader | jaffacakes118_980546f13bdfb6b0b54261b06b7ac5dc6aad99305f8c0c8a6b2b765ac5e72afe[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_980546f13bdfb6b0b54261b06b7ac5dc6aad99305f8c0c8a6b2b765ac5e72afe.bin
Size 331KB
Sample260925-falwzazbmd
SHA256 980546f13bdfb6b0b54261b06b7ac5dc6aad99305f8c0c8a6b2b765ac5e72afe
MD5 d1d4acc17cca1005069e10bdec446038
SHA1 583d1b6d1f3f13fb8c5b2f42c81539aadd5b80ca
SHA512 f3856df913924ccb288e8c6bfefb1e144e356bdd2d946de6c90783a5b2fac65213cd9058bd0d2faefa617f01dcd3f043b3874e3fdbfaed950c6ade611418cae1
SSDEEP 6144:g1ZbpauafKPUJwYXYG8P+h4woabxUMZpmehjTB5cm3:W0uafK0wYiIL/fhjTHv3
TLSH
T17F746D32B6808437D1636E7CEC5B96B8A83D7E202D78645B7AD85F0C4B3A29175743C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan modiloader

Malware Config

Signatures

Family: ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_980546f13bdfb6b0b54261b06b7ac5dc6aad99305f8c0c8a6b2b765ac5e72afe.bin

File Explorer

jaffacakes118_980546f13bdfb6b0b54261b06b7ac5dc6aad99305f8c0c8a6b2b765ac5e72afe.bin

.dll 331KB

jaffacakes118_980546f13bdfb6b0b54261b06b7ac5dc6aad99305f8c0c8a6b2b765ac5e72afe.bin

SHA256 980546f13bdfb6b0b54261b06b7ac5dc6aad99305f8c0c8a6b2b765ac5e72afe
MD5 d1d4acc17cca1005069e10bdec446038
SHA1 583d1b6d1f3f13fb8c5b2f42c81539aadd5b80ca
SHA512 f3856df913924ccb288e8c6bfefb1e144e356bdd2d946de6c90783a5b2fac65213cd9058bd0d2faefa617f01dcd3f043b3874e3fdbfaed950c6ade611418cae1
SSDEEP 6144:g1ZbpauafKPUJwYXYG8P+h4woabxUMZpmehjTB5cm3:W0uafK0wYiIL/fhjTHv3
TLSH
T17F746D32B6808437D1636E7CEC5B96B8A83D7E202D78645B7AD85F0C4B3A29175743C7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ModiLoader Second Stage
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

280056

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

270KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

73B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.topo0

Size

512B

Virtual Size

50B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_980546f13bdfb6b0b54261b06b7ac5dc6aad99305f8c0c8a6b2b765ac5e72afe.bin

generic