General
-
Target
ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118
-
Size
320KB
-
Sample
240618-jpe9hstfld
-
MD5
ba8dd5eacf990e08bd61dbbc89328600
-
SHA1
098712007722fb34b4d47a8d0b289a3f0ee12667
-
SHA256
62b33d9024e2987cb8326827b9fddbc81c74f8bf10abdc8ea7ff7325d3646e66
-
SHA512
9a9b6295a0bd7ea551c4577f6e5d476b3a5885794f1bc24dd56b1c1b7dc77ae7fe0ca0b5b18f949fb5040b533641f86bf07fa93e66b4626c0b88408fc41d620d
-
SSDEEP
6144:qWkHk7Gknm0qSDlhHFj6SWC1e3jKb9wWF/QYD53:8E77m0DhpFOSWlWnFrDZ
Malware Config
Targets
-
-
Target
ba8dd5eacf990e08bd61dbbc89328600_JaffaCakes118
-
Size
320KB
-
MD5
ba8dd5eacf990e08bd61dbbc89328600
-
SHA1
098712007722fb34b4d47a8d0b289a3f0ee12667
-
SHA256
62b33d9024e2987cb8326827b9fddbc81c74f8bf10abdc8ea7ff7325d3646e66
-
SHA512
9a9b6295a0bd7ea551c4577f6e5d476b3a5885794f1bc24dd56b1c1b7dc77ae7fe0ca0b5b18f949fb5040b533641f86bf07fa93e66b4626c0b88408fc41d620d
-
SSDEEP
6144:qWkHk7Gknm0qSDlhHFj6SWC1e3jKb9wWF/QYD53:8E77m0DhpFOSWlWnFrDZ
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks for common network interception software
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VirtualBox drivers on disk
-
ModiLoader Second Stage
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself
-
Drops startup file
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1