Overview

overview

10

Static

static

3

0172264747...18.exe

windows7-x64

10

0172264747...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    01722647475d5e9cc01a105dbaa2e979_JaffaCakes118

  • Size

    100KB

  • Sample

    240620-avz2fatclm

  • MD5

    01722647475d5e9cc01a105dbaa2e979

  • SHA1

    5e855c25f769f4ca1eb471b724bfe9bb26442bfb

  • SHA256

    558dd090d548d4fa192d65533fc151b509ea7fc852fbeb16e3c43813b22faee2

  • SHA512

    649d999fa4d57d8929bce9c8fe301979b671f0951aef0d22355daba823b6e9df37c49d6aaa2d92190e34d6c096316ed4d7424562cb68974ce99ed2b5a8049753

  • SSDEEP

    1536:XVtksz1n+yGk3oYyIoP6moZkD+ucrwWkGJq0L11t35EMlII6L/PzqI1QKJRoA:DzbG4D5oPYZkOkne11fh56L/PZJ

Score
10/10
modiloaderpersistencetrojan

Malware Config

Targets

    • Target

      01722647475d5e9cc01a105dbaa2e979_JaffaCakes118

    • Size

      100KB

    • MD5

      01722647475d5e9cc01a105dbaa2e979

    • SHA1

      5e855c25f769f4ca1eb471b724bfe9bb26442bfb

    • SHA256

      558dd090d548d4fa192d65533fc151b509ea7fc852fbeb16e3c43813b22faee2

    • SHA512

      649d999fa4d57d8929bce9c8fe301979b671f0951aef0d22355daba823b6e9df37c49d6aaa2d92190e34d6c096316ed4d7424562cb68974ce99ed2b5a8049753

    • SSDEEP

      1536:XVtksz1n+yGk3oYyIoP6moZkD+ucrwWkGJq0L11t35EMlII6L/PzqI1QKJRoA:DzbG4D5oPYZkOkne11fh56L/PZJ

    Score
    10/10
    modiloaderpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Server Software Component

1
T1505

Terminal Services DLL

1
T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks