General

  • Target

    097d297d04200e1094a2ca5694303587_JaffaCakes118

  • Size

    636KB

  • Sample

    240620-1gashascln

  • MD5

    097d297d04200e1094a2ca5694303587

  • SHA1

    ffae1a3f4e314d6f7783fff3b70ba638e8653131

  • SHA256

    09fa9e5b270fb1e33ade2295bd56dd00194013f5b42e8618ed8eb733798290ef

  • SHA512

    d1238e5430360f83ad8c32527657e819af356d5ac8fd6f958a3751ca0d8cf6b754b95f352d658dd1da7596a13aed8f8a74269ef676366281b62002b24b57d604

  • SSDEEP

    12288:LJkV9+yzCWv4nS+MPxcnc5g/ftF3Z4mxxz7Zm1jGmYae4mrRO:VSBrvRDPyc5g3tQmXzlmlGmI4

Score
10/10

Malware Config

Targets

    • Target

      097d297d04200e1094a2ca5694303587_JaffaCakes118

    • Size

      636KB

    • MD5

      097d297d04200e1094a2ca5694303587

    • SHA1

      ffae1a3f4e314d6f7783fff3b70ba638e8653131

    • SHA256

      09fa9e5b270fb1e33ade2295bd56dd00194013f5b42e8618ed8eb733798290ef

    • SHA512

      d1238e5430360f83ad8c32527657e819af356d5ac8fd6f958a3751ca0d8cf6b754b95f352d658dd1da7596a13aed8f8a74269ef676366281b62002b24b57d604

    • SSDEEP

      12288:LJkV9+yzCWv4nS+MPxcnc5g/ftF3Z4mxxz7Zm1jGmYae4mrRO:VSBrvRDPyc5g3tQmXzlmlGmI4

    Score
    10/10
    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks