Overview

overview

10

Static

static

3

831ef50525...18.exe

windows7-x64

10

831ef50525...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    831ef50525451ce1804e77eef61cdf28_JaffaCakes118

  • Size

    466KB

  • Sample

    240530-fstdrsff9y

  • MD5

    831ef50525451ce1804e77eef61cdf28

  • SHA1

    3341d4a3668315d9b132fe61c198a803e363be2d

  • SHA256

    898d1131c18d09fe4812ecd669a7917dbc6cff5d646104b362c423e57237a1cb

  • SHA512

    5708d01929db9dcf04ef5e45c33c2ab048e29dc3efb9b612aaf61e18767b993041a8dd17abdf53e5bed7737a2cdac6871242df769a163e58b1e240699d6a24d1

  • SSDEEP

    6144:WE2eW9agXVbOvVuXz9zNVZjOyJOeDywccVHf2+vieBvtmmv8nHHz/+OVzzfo/D7B:WE2eW9pIezPVZZDDjc+vFBvYrHtg/va+

Score
10/10
modiloaderevasionpersistencetrojan

Malware Config

Targets

    • Target

      831ef50525451ce1804e77eef61cdf28_JaffaCakes118

    • Size

      466KB

    • MD5

      831ef50525451ce1804e77eef61cdf28

    • SHA1

      3341d4a3668315d9b132fe61c198a803e363be2d

    • SHA256

      898d1131c18d09fe4812ecd669a7917dbc6cff5d646104b362c423e57237a1cb

    • SHA512

      5708d01929db9dcf04ef5e45c33c2ab048e29dc3efb9b612aaf61e18767b993041a8dd17abdf53e5bed7737a2cdac6871242df769a163e58b1e240699d6a24d1

    • SSDEEP

      6144:WE2eW9agXVbOvVuXz9zNVZjOyJOeDywccVHf2+vieBvtmmv8nHHz/+OVzzfo/D7B:WE2eW9pIezPVZZDDjc+vFBvYrHtg/va+

    Score
    10/10
    modiloaderevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

      evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • ModiLoader Second Stage

    • Adds policy Run key to start application

      persistence

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks