Overview

overview

10

Static

static

7

0390c7e502...18.exe

windows7-x64

10

0390c7e502...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0390c7e5023e933bdf80ef1a4c0493c5_JaffaCakes118

  • Size

    108KB

  • Sample

    240620-g2bqraxgll

  • MD5

    0390c7e5023e933bdf80ef1a4c0493c5

  • SHA1

    02dff287cd3151d38773cd4c9f8ff09ff376dfb4

  • SHA256

    550b8848165837ae42f30ebacac184a343ed6ebc3d8324eba3762e7d2744ab5b

  • SHA512

    d080e74ac9550dbb69f28a8607ee5a2d3e182df84863bda976536aab96c87e2ca1ca41474aaa5cac55b961cd56e24fdb615d80400e0974731688ec0ccb3e86de

  • SSDEEP

    3072:Moy8j7VnNdrPHaSekwi+mW+2cWAHDout:88jZ7rvaU3+mWrcWaoS

Score
10/10
modiloaderevasiontrojanupx

Malware Config

Targets

    • Target

      0390c7e5023e933bdf80ef1a4c0493c5_JaffaCakes118

    • Size

      108KB

    • MD5

      0390c7e5023e933bdf80ef1a4c0493c5

    • SHA1

      02dff287cd3151d38773cd4c9f8ff09ff376dfb4

    • SHA256

      550b8848165837ae42f30ebacac184a343ed6ebc3d8324eba3762e7d2744ab5b

    • SHA512

      d080e74ac9550dbb69f28a8607ee5a2d3e182df84863bda976536aab96c87e2ca1ca41474aaa5cac55b961cd56e24fdb615d80400e0974731688ec0ccb3e86de

    • SSDEEP

      3072:Moy8j7VnNdrPHaSekwi+mW+2cWAHDout:88jZ7rvaU3+mWrcWaoS

    Score
    10/10
    modiloaderevasiontrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks