ModernLoader Used to Deliver More Malware

ModernLoader is the name of a newly discovered malicious tool. The malware acts as a remote access trojan or a RAT.

ModernLoader is associated with a multi-payload, multi-stage attack conducted by threat actors over several months in 2022. The hackers behind the attack were initially using PowerShell, as well as .NET assemblies and malicious Virtual Basic scripts to gain initial access to their targets.

ModernLoader was one of the several different payloads that were dumped onto the targeted networks in those attacks, usually culminating with the deployment of ModernLoader.

The malware has most of the functionality you would expect from a remote access trojan. It can scrape and exfiltrate system information and deploy various other modules. The collected information includes OS version, physical memory installed on the system, processor type, presence of anti-malware solutions, drive space left on the system and level of user privileges.

The main goal of the ModernLoader malware is to pull modules from the command and control servers of the threat actor and deploy them on the infected networks. This allows the hackers greater flexibility, as they can dynamically change the payloads and adapt to different campaigns.