modiloader | f785cc537cb807746d44c134899d64c9133b22c958f0cb4dd7a92f5af9da413f

General

Target

f785cc537cb807746d44c134899d64c9133b22c958f0cb4dd7a92f5af9da413f.exe
Size

1.1MB
Sample

240628-cdckxsveqc
MD5

b3e46d9e108107da316136965308482d
SHA1

e6fe35708b4fe7b16bbf41596953fe5e8ff53b2a
SHA256

f785cc537cb807746d44c134899d64c9133b22c958f0cb4dd7a92f5af9da413f
SHA512

9724d2ebe1137ac605586b13d0d0d58c8bb5e65edc22ffee162ac318db97f13e4bd6d4175721fb51c163751e4a3de23ee7456e229e499ea751ef4f827d4d9438
SSDEEP

12288:uSO7HrAp5/yBMHZ0tdOsUDSo4Or9p+jDngeGF6OLMyWpldQ1QHFwfmxysAkmCqff:0fC/yuHZ0tdgDSvw9p8D7Gd9xu+DTSq

Score

10^/10

Malware Config

Targets

- Target
  
  f785cc537cb807746d44c134899d64c9133b22c958f0cb4dd7a92f5af9da413f.exe
- Size
  
  1.1MB
- MD5
  
  b3e46d9e108107da316136965308482d
- SHA1
  
  e6fe35708b4fe7b16bbf41596953fe5e8ff53b2a
- SHA256
  
  f785cc537cb807746d44c134899d64c9133b22c958f0cb4dd7a92f5af9da413f
- SHA512
  
  9724d2ebe1137ac605586b13d0d0d58c8bb5e65edc22ffee162ac318db97f13e4bd6d4175721fb51c163751e4a3de23ee7456e229e499ea751ef4f827d4d9438
- SSDEEP
  
  12288:uSO7HrAp5/yBMHZ0tdOsUDSo4Or9p+jDngeGF6OLMyWpldQ1QHFwfmxysAkmCqff:0fC/yuHZ0tdgDSvw9p8D7Gd9xu+DTSq
Score

10^/10

modiloader persistence spyware stealer trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Detect packed .NET executables. Mostly AgentTeslaV4.
- ModiLoader Second Stage
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Targets

ModiLoader, DBatLoader

Detect packed .NET executables. Mostly AgentTeslaV4.

ModiLoader Second Stage

Executes dropped EXE

Loads dropped DLL

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2