General
-
Target
0d976e37104fe37583888d89ccd422dc_JaffaCakes118
-
Size
492KB
-
Sample
240625-lpnl1avgmn
-
MD5
0d976e37104fe37583888d89ccd422dc
-
SHA1
6e9179bb86e029a98f6f0ca63916e3d1191e967c
-
SHA256
0b56654db6da323286fa50d2ee6abfd9bd95ec4c9726ba803d5f86a7321c096b
-
SHA512
a255cca0beff30c828b2c2a0733dc8b1e7523a9a531b5b686fb8bd55ebe69798389bf45c705051811d830ea25b287210101bcbcfb7230fd080c05ea514374db4
-
SSDEEP
12288:LjuTkMa586N2rAs3e3D35UQpXyjWz8iu6pqXALLbr2U7QFxyzw:LsUNl6yD2KXYWzj3rZQFz
Static task
static1
Behavioral task
behavioral1
Sample
0d976e37104fe37583888d89ccd422dc_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0d976e37104fe37583888d89ccd422dc_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
0d976e37104fe37583888d89ccd422dc_JaffaCakes118
-
Size
492KB
-
MD5
0d976e37104fe37583888d89ccd422dc
-
SHA1
6e9179bb86e029a98f6f0ca63916e3d1191e967c
-
SHA256
0b56654db6da323286fa50d2ee6abfd9bd95ec4c9726ba803d5f86a7321c096b
-
SHA512
a255cca0beff30c828b2c2a0733dc8b1e7523a9a531b5b686fb8bd55ebe69798389bf45c705051811d830ea25b287210101bcbcfb7230fd080c05ea514374db4
-
SSDEEP
12288:LjuTkMa586N2rAs3e3D35UQpXyjWz8iu6pqXALLbr2U7QFxyzw:LsUNl6yD2KXYWzj3rZQFz
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies visiblity of hidden/system files in Explorer
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Suspicious use of SetThreadContext
-