General

  • Target

    0a8cbc000c2237a8b535b9880ee32507_JaffaCakes118

  • Size

    379KB

  • Sample

    240430-18dngaba29

  • MD5

    0a8cbc000c2237a8b535b9880ee32507

  • SHA1

    4fa6fa14241e8e741fbbdec6842fe715c3345548

  • SHA256

    677a5efdbfacfeaf4ecb6aa3e7d70033064fe8b4d6ba8bc603a6678d2b6d6d33

  • SHA512

    75d5adc72b72b851b922fa47f57380129b4e576f00b921237e450b575726cc11e4c4103f419f48e555af289dd2b3d7dc56df521844e332408622d667cf03e7b7

  • SSDEEP

    6144:k3qofZmjFxaE1UGGGZLMpaKjkFPR4DOaIytdtyHXZpq0TWZCm9t3O:kao8xaE1SG9Mpk7VaIS2ZR

Malware Config

Targets

    • Target

      0a8cbc000c2237a8b535b9880ee32507_JaffaCakes118

    • Size

      379KB

    • MD5

      0a8cbc000c2237a8b535b9880ee32507

    • SHA1

      4fa6fa14241e8e741fbbdec6842fe715c3345548

    • SHA256

      677a5efdbfacfeaf4ecb6aa3e7d70033064fe8b4d6ba8bc603a6678d2b6d6d33

    • SHA512

      75d5adc72b72b851b922fa47f57380129b4e576f00b921237e450b575726cc11e4c4103f419f48e555af289dd2b3d7dc56df521844e332408622d667cf03e7b7

    • SSDEEP

      6144:k3qofZmjFxaE1UGGGZLMpaKjkFPR4DOaIytdtyHXZpq0TWZCm9t3O:kao8xaE1SG9Mpk7VaIS2ZR

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    • Looks for VirtualBox Guest Additions in registry

    • ModiLoader Second Stage

    • Adds policy Run key to start application

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Adds Run key to start application

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks