modiloader | edc505c4629a550f9356a06ce7f24bfffca9a39b0dd98da8234b1366b1ec5520

General

Target

1b07681e664e306e849cfac378fd5c36_JaffaCakes118
Size

7.2MB
Sample

240701-m2eqas1bmp
MD5

1b07681e664e306e849cfac378fd5c36
SHA1

18c2aa65af42a6c17826e65b2d11e7a8da15555b
SHA256

edc505c4629a550f9356a06ce7f24bfffca9a39b0dd98da8234b1366b1ec5520
SHA512

e38280a95ea0979c54d4832ece66ab7841dc8f8489c5e7a72846e4f733ed60ba8121d0b3ee6dc711936cec54d12c267d1d25923e7bddc97785b57d531d73e97e
SSDEEP

196608:BuezwW++1nerHAOdMF69hTmo/7H4gsQ6hAady5q0V+amY:9zw5+crHALF69hTmO7DsVEqVax

Score

10^/10

Malware Config

Targets

- Target
  
  1b07681e664e306e849cfac378fd5c36_JaffaCakes118
- Size
  
  7.2MB
- MD5
  
  1b07681e664e306e849cfac378fd5c36
- SHA1
  
  18c2aa65af42a6c17826e65b2d11e7a8da15555b
- SHA256
  
  edc505c4629a550f9356a06ce7f24bfffca9a39b0dd98da8234b1366b1ec5520
- SHA512
  
  e38280a95ea0979c54d4832ece66ab7841dc8f8489c5e7a72846e4f733ed60ba8121d0b3ee6dc711936cec54d12c267d1d25923e7bddc97785b57d531d73e97e
- SSDEEP
  
  196608:BuezwW++1nerHAOdMF69hTmo/7H4gsQ6hAady5q0V+amY:9zw5+crHALF69hTmO7DsVEqVax
Score

10^/10

modiloader persistence spyware stealer trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Targets

ModiLoader, DBatLoader

ModiLoader Second Stage

Adds policy Run key to start application

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

UPX packed file

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2