General
-
Target
3c1d8865a54c4aa1d8956fc8e72a35b4_JaffaCakes118
-
Size
538KB
-
Sample
240513-wkgb8sfh9s
-
MD5
3c1d8865a54c4aa1d8956fc8e72a35b4
-
SHA1
05ceb4901d84f3839a6842ecbfbf0fd9eb5bbc52
-
SHA256
621e617af46e9f77a5bcbcf9c65ec47b9336f7b98f457363dc57746665c38623
-
SHA512
b185050d1b99904f30b78f26bc5cacbb56d5b67e6116334a3c68c947b4024648a2dd2ce9600f14ed378bcecae3946993d88915ad96bad70ca435fec687e358e8
-
SSDEEP
12288:kC9ESWxqf8NJz02ciJzSPu/27D6s2r3ZEA7Hg96pTA:r91f8NPHCZ34rpEA7Hg96p8
Static task
static1
Behavioral task
behavioral1
Sample
3c1d8865a54c4aa1d8956fc8e72a35b4_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3c1d8865a54c4aa1d8956fc8e72a35b4_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
3c1d8865a54c4aa1d8956fc8e72a35b4_JaffaCakes118
-
Size
538KB
-
MD5
3c1d8865a54c4aa1d8956fc8e72a35b4
-
SHA1
05ceb4901d84f3839a6842ecbfbf0fd9eb5bbc52
-
SHA256
621e617af46e9f77a5bcbcf9c65ec47b9336f7b98f457363dc57746665c38623
-
SHA512
b185050d1b99904f30b78f26bc5cacbb56d5b67e6116334a3c68c947b4024648a2dd2ce9600f14ed378bcecae3946993d88915ad96bad70ca435fec687e358e8
-
SSDEEP
12288:kC9ESWxqf8NJz02ciJzSPu/27D6s2r3ZEA7Hg96pTA:r91f8NPHCZ34rpEA7Hg96p8
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Checks for common network interception software
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Looks for VirtualBox Guest Additions in registry
-
ModiLoader Second Stage
-
Adds policy Run key to start application
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-