modiloader | jaffacakes118_aaa25b18ee17d3dd20c8234d411f42a3e09115540bcc79a0e42e7100d009a208[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_aaa25b18ee17d3dd20c8234d411f42a3e09115540bcc79a0e42e7100d009a208.bin
Size 90KB
Sample260926-cx69msba86
SHA256 aaa25b18ee17d3dd20c8234d411f42a3e09115540bcc79a0e42e7100d009a208
MD5 8a92e53c1f00ad216ef1d9408bf57acf
SHA1 ee566fbc2749a931abbb590e6bb5b925f0886ae5
SHA512 4a73b1d49f175d7c09c78915a1c3eb16f13e94def136c44ece98d273f1a929fb84107f07fdf5522e0fa244a88f1155c4ec4e5d0cfe4972cb0036e42706a885a8
SSDEEP 768:ps8d22LdX9wTB0DTzLIlLWx2GQrddXq80IE9B5t7V0DuQeqafDkD2wT0GGGN9GGt:p7XLdievgiQpdAXP7tqarWv/Lda6
TLSH
T1D7932806BE82C670C014E9F6CF4BC3F55A5B3D171E1185A3B5A73B8E6E3AA43D90E149
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan modiloader

Malware Config

Signatures

Family: ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_aaa25b18ee17d3dd20c8234d411f42a3e09115540bcc79a0e42e7100d009a208.bin

File Explorer

jaffacakes118_aaa25b18ee17d3dd20c8234d411f42a3e09115540bcc79a0e42e7100d009a208.bin

.exe 90KB

jaffacakes118_aaa25b18ee17d3dd20c8234d411f42a3e09115540bcc79a0e42e7100d009a208.bin

SHA256 aaa25b18ee17d3dd20c8234d411f42a3e09115540bcc79a0e42e7100d009a208
MD5 8a92e53c1f00ad216ef1d9408bf57acf
SHA1 ee566fbc2749a931abbb590e6bb5b925f0886ae5
SHA512 4a73b1d49f175d7c09c78915a1c3eb16f13e94def136c44ece98d273f1a929fb84107f07fdf5522e0fa244a88f1155c4ec4e5d0cfe4972cb0036e42706a885a8
SSDEEP 768:ps8d22LdX9wTB0DTzLIlLWx2GQrddXq80IE9B5t7V0DuQeqafDkD2wT0GGGN9GGt:p7XLdievgiQpdAXP7tqarWv/Lda6
TLSH
T1D7932806BE82C670C014E9F6CF4BC3F55A5B3D171E1185A3B5A73B8E6E3AA43D90E149
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ModiLoader Second Stage
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

512B

Virtual Size

164B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_aaa25b18ee17d3dd20c8234d411f42a3e09115540bcc79a0e42e7100d009a208.bin

generic