Overview

overview

10

Static

static

10

AutoPowerO...on.exe

windows7-x64

7

AutoPowerO...on.exe

windows10-2004-x64

7

$PLUGINSDI...on.exe

windows7-x64

7

$PLUGINSDI...on.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

AutoPower.exe

windows7-x64

10

AutoPower.exe

windows10-2004-x64

10

Help.chm

windows7-x64

1

Help.chm

windows10-2004-x64

1

RunDLL.dll

windows7-x64

3

RunDLL.dll

windows10-2004-x64

3

SASHOOK.dll

windows7-x64

3

SASHOOK.dll

windows10-2004-x64

3

autoss.exe

windows7-x64

10

autoss.exe

windows10-2004-x64

10

disktop.exe

windows7-x64

1

disktop.exe

windows10-2004-x64

1

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

AutoPowerO...��.htm

windows7-x64

1

AutoPowerO...��.htm

windows10-2004-x64

1

AutoPowerO...�).url

windows7-x64

1

AutoPowerO...�).url

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5b518a9f9d968ff562d860db70623b78_JaffaCakes118

  • Size

    1.5MB

  • MD5

    5b518a9f9d968ff562d860db70623b78

  • SHA1

    7a378598a9f3630569f19d5895fafc941aadfedb

  • SHA256

    e723ee615d7a64e918ab185b645324a0cb1b376302d33b54995b54da39be51f3

  • SHA512

    4edc32123b72b7ea6f79fdd98694d68732cfcac7475350aa31ac9f6f051a08e0d283ac5878477498f5dedae5759c56f0727375d70a5430a625f11f0d23af2cb7

  • SSDEEP

    49152:iPhv1CoBZphZwKNvHjdJB6nMhRrkZ54IC:ip9BwKhUnirkZjC

Score
10/10
modiloader

Malware Config

Signatures

  • ModiLoader Second Stage 2 IoCs
  • Modiloader family
    modiloader
  • Unsigned PE 9 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 6 IoCs
    installer

Files

  • 5b518a9f9d968ff562d860db70623b78_JaffaCakes118
    .rar
  • AutoPowerOn_windown8/AutoPowerOn/autopoweron.exe
    .exe windows:4 windows x86 arch:x86

    dd1742eadfc6df18ded3c26ae64ad610


    Headers

    Imports

    Sections

  • $PLUGINSDIR/autopoweron.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • 156.ico
  • 56.ico
  • AutoPower.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Help.chm
    .chm
  • Longhorn.sui
  • RunDLL.dll
    .dll windows:4 windows x86 arch:x86

    4b0f1882f1594b426e1addaaa491fab4


    Headers

    Imports

    Exports

    Sections

  • SASHOOK.dll
    .dll windows:4 windows x86 arch:x86

    86d14aad387236b04c18c28ff4449a58


    Headers

    Imports

    Exports

    Sections

  • autoss.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • disktop.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • help.txt
  • lic.txt
  • ling.wav
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • wake.ini
  • AutoPowerOn_windown8/下载说明.htm
    .html
  • AutoPowerOn_windown8/使用帮助(河东软件园).url
    .url
  • AutoPowerOn_windown8/使用说明.txt