Overview

overview

10

Static

static

3

03d6a06741...18.exe

windows7-x64

10

03d6a06741...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    03d6a067416e684cba893542c4ff1094_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240620-hr38pazaqn

  • MD5

    03d6a067416e684cba893542c4ff1094

  • SHA1

    ad1540618c02545b54b3d6f6785d565569c17ab7

  • SHA256

    5ab8d01b8144e70ab1e5720ec8e672695068439c8e65b7bd884944117aa00e40

  • SHA512

    7ed26f125ec87ed34131e31352132d2b4dd8aff850cb5b2a38420b7d77ccf430be9b222aa0c2e83fcd5aa401a0a521ae588524481b0a66fd3f452b447fa3c2e5

  • SSDEEP

    24576:BzNYD0Wr6ULip3Z/A7nDTz+KHfAcV8towmD0Wr6sP7:tqD0W9iZMnDpfAu1D0W9

Score
10/10
darkcometmodiloaderbootkitpersistencerattrojan

Malware Config

Targets

    • Target

      03d6a067416e684cba893542c4ff1094_JaffaCakes118

    • Size

      1.3MB

    • MD5

      03d6a067416e684cba893542c4ff1094

    • SHA1

      ad1540618c02545b54b3d6f6785d565569c17ab7

    • SHA256

      5ab8d01b8144e70ab1e5720ec8e672695068439c8e65b7bd884944117aa00e40

    • SHA512

      7ed26f125ec87ed34131e31352132d2b4dd8aff850cb5b2a38420b7d77ccf430be9b222aa0c2e83fcd5aa401a0a521ae588524481b0a66fd3f452b447fa3c2e5

    • SSDEEP

      24576:BzNYD0Wr6ULip3Z/A7nDTz+KHfAcV8towmD0Wr6sP7:tqD0W9iZMnDpfAu1D0W9

    Score
    10/10
    darkcometmodiloaderbootkitpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies WinLogon for persistence

      persistence

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks