General
-
Target
58f6534ece6b72af1d5f1139602a0e81_JaffaCakes118
-
Size
784KB
-
Sample
240519-g26acseb7x
-
MD5
58f6534ece6b72af1d5f1139602a0e81
-
SHA1
d8ad50ce09f83f4c48958dadfa60681585158d3d
-
SHA256
890bbe475734f839aa2bf1cf29259b1d51734edfda448ecaafb33b14f4f3846b
-
SHA512
c318afb06b02feb50b673b2e425a1d80a2997f87f3fc3b38aa0696c4cc369422faa024710f2bc4cab56b4131f14cace2e415cbf446e7411ab07030898ff2a528
-
SSDEEP
12288:FZMbXTIqS/SNjY8Vaw3ccagWju/6UOnpFF06ZIOXa7/JYzKto9AYy4hFVLr9iO0:sbXcq9jY8IHfgWjBp06ZpMJYqoC49it
Static task
static1
Behavioral task
behavioral1
Sample
Price-list-Yuan 2016.6.8_545_54.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
Price-list-Yuan 2016.6.8_545_54.exe
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
Price-list-Yuan 2016.6.8_545_54.exe
-
Size
912KB
-
MD5
0564ba769d20df8f127c1f491e6a5540
-
SHA1
f4c47f8fd8a402bdd5c05aff882b1dace1633186
-
SHA256
153df0b62b32abea05a68d9f9bdb1d0ceadd5fe04dd1334b7d6053afb67309fe
-
SHA512
e6b3a837db38293ed6a4cca20af53a2cb0387af61945e9fdcf78da3ba2a8ffa47172ddff1fcf262d23812dc72205bd32156c46215d46a88525986f1afa317fee
-
SSDEEP
24576:ETzSqlFYcq/ZgmvTZ06L5+JYmm2gackH:ELTCvvt0g4JYNazH
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Adds policy Run key to start application
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3