Netskope Threat Labs

ModernLoader

ATP Sandbox Adv. HeuristicsAVNetskope IPS

ModernLoader (a.k.a. Avatar Bot, AvatarLoader) is a malicious program that combines minimalistic loader functionality with remote access trojan features. It can execute basic commands and inject malicious modules into compromised systems, serving as both an entry point and a remote control implant.

First seen
October 2022
Last seen
October 2026
Modernloader
Alert Name
Dump:Generic.PWSH.ModernLoader.B.FFFFFFFE
Generic.PWSH.ModernLoader.A.1540E335
Generic.PWSH.ModernLoader.A.7A12566E
Generic.PWSH.ModernLoader.A.A2150053
Generic.PWSH.ModernLoader.A.A62F6043
Generic.PWSH.ModernLoader.A.AA98CEE6
Generic.PWSH.ModernLoader.A.B13BA7FD
Generic.PWSH.ModernLoader.A.BD114A5A
Generic.PWSH.ModernLoader.A.C733F5A2
Generic.PWSH.ModernLoader.A.DA76E4B6