Rewterz Threat Alert – ModiLoader aka DBatLoader – Active IOCs

Severity

Medium

Analysis Summary

ModiLoader – aka DBatLoader or NatsoLoader – was initially identified in June 2020. It is a two-stage loader that has been seen distributing the Remcos, Formbook, and Netwire trojans. This malware is typically spread through malicious email attachments, or by being bundled with legitimate software.

Once a user’s device is infected with ModiLoader, it can perform several malicious actions such as:

• Download and install additional malware, such as ransomware or banking Trojans.
• Create a backdoor into the infected device, allowing hackers to gain access and control of the device.
• Collect and exfiltrate sensitive information from the infected device.
• Install additional payloads such as keyloggers, remote access tools, or even cryptocurrency mining software.
• Evade detection by changing the file names and executing from the memory.

ModiLoader is a persistent malware and uses various techniques to evade detection such as:

• Hiding the payload in a legitimate-looking file or hiding it in legitimate Windows system processes.
• Encrypting the payload to avoid detection by signature-based anti-virus software.
• Using a variety of anti-debugging and anti-emulation techniques to avoid detection by security researchers.

It is important to keep your device and software up to date and to exercise caution when opening email attachments or installing software from unfamiliar sources to protect against ModiLoader and other types of malware. In addition, using reputable anti-virus software and keeping it updated can help protect against ModiLoader and other types of malware.

Impact

• Sensitive Information Theft
• Data Exfiltration

Indicators of Compromise

MD5

• eadf45168483d97ac2f5d2aebaef197e
• cafddd17b720ad5406b922d9d83ca67c
• 54a3a3eb46f4eb5dede87218e5b262f2
• a91f942248aa67ff4d4646cf4b0f3921
• 0ca3ab2fcc924dca6f75e642608e7333

SHA-256

• 51f0e355999c88115aadaa3afeec3e5e6ef4bd60e6c049b989531c83281f9e38
• 080d9e7d7fd848bb870ffb7a2bf35c0534af866f42b45357dcdd1261ddc39fb8
• 50798e5f883e4c0884918c73e59daf1803fa0ca10ebf5ead8fc8c1367a431cc8
• ec00ed204cf14b949776b2c8abca168a1f2ba696ee660ee5d1b6cd617e29fc59
• 9c4f07bf03072c9ad7574534308038647ce670fa94be0556da59560dbcb10acd

SHA-1

• 98667892c10842868ca34b0a9b966e6baaa9ce7c
• cb8f6d9eb78288129c369572cddbbff0ea589212
• aecd121b32283578c45733d855f983c6ba6fffd6
• 103f6dd888729b9025103c47b0f2b72ada68be89
• cb4bbfe04d6565ac0f209917829bacfad4f79b31

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
• Enable antivirus and anti-malware software and update signature definitions promptly. Using multi-layered protection is necessary to secure vulnerable assets.
• Patch and upgrade any platforms and software timely and make it into a standard security policy.