Overview

overview

10

Static

static

7

020f16b063...18.exe

windows7-x64

10

020f16b063...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    020f16b063839725abb42290a939694e_JaffaCakes118

  • Size

    80KB

  • Sample

    240620-czzycatflc

  • MD5

    020f16b063839725abb42290a939694e

  • SHA1

    0c985d986403caeba4923ea0f18b449ca468558e

  • SHA256

    6079ed711139394a38ffe43963f077ea892992786ca62536d7ab6be25fb20b92

  • SHA512

    8eb6501cc6889a409bed197739cebb8d21df9ef997913978a10487d793f4306bda295ef52f123181ea41ede4866875c4d3758b7aa3df2b23cd9994c70417b9e6

  • SSDEEP

    1536:2wRwOV9CjyB5YOJ23+jzI4t3w28HkJXqQiYonfnPK9Tx9nouy8:3Rw8vB5Yrujz93wrwXxi/PITbout

Score
10/10
modiloadertrojanupx

Malware Config

Targets

    • Target

      020f16b063839725abb42290a939694e_JaffaCakes118

    • Size

      80KB

    • MD5

      020f16b063839725abb42290a939694e

    • SHA1

      0c985d986403caeba4923ea0f18b449ca468558e

    • SHA256

      6079ed711139394a38ffe43963f077ea892992786ca62536d7ab6be25fb20b92

    • SHA512

      8eb6501cc6889a409bed197739cebb8d21df9ef997913978a10487d793f4306bda295ef52f123181ea41ede4866875c4d3758b7aa3df2b23cd9994c70417b9e6

    • SSDEEP

      1536:2wRwOV9CjyB5YOJ23+jzI4t3w28HkJXqQiYonfnPK9Tx9nouy8:3Rw8vB5Yrujz93wrwXxi/PITbout

    Score
    10/10
    modiloadertrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks