Overview

overview

10

Static

static

3

2116d71e88...18.exe

windows7-x64

10

2116d71e88...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2116d71e88ced26d4edb818ebd30d934_JaffaCakes118

  • Size

    213KB

  • Sample

    240703-e6j7ksxfjc

  • MD5

    2116d71e88ced26d4edb818ebd30d934

  • SHA1

    961c0e6668e6465b5e438c823a9a286b5cbfa4f6

  • SHA256

    a6ad9566c639aab349ad98b8f47e891b0b7c5a7b5fea28063f04d5adff6d7943

  • SHA512

    0f5a1290551c3cc3fbd6862afb2812f14932ee29c61061ffc7ed085581fb7439a4dd5649dd41978b2c8c7013be053e86b733c3229fa1cd04932a5110115d5803

  • SSDEEP

    6144:ouKfKi1Z41x8dQ4LfP9NHGNc9Sccn8hqV3o1482D/6S:oJCi1Zue3LfPYc9ScuV3VDX

Score
10/10
modiloaderpersistencetrojanupx

Malware Config

Targets

    • Target

      2116d71e88ced26d4edb818ebd30d934_JaffaCakes118

    • Size

      213KB

    • MD5

      2116d71e88ced26d4edb818ebd30d934

    • SHA1

      961c0e6668e6465b5e438c823a9a286b5cbfa4f6

    • SHA256

      a6ad9566c639aab349ad98b8f47e891b0b7c5a7b5fea28063f04d5adff6d7943

    • SHA512

      0f5a1290551c3cc3fbd6862afb2812f14932ee29c61061ffc7ed085581fb7439a4dd5649dd41978b2c8c7013be053e86b733c3229fa1cd04932a5110115d5803

    • SSDEEP

      6144:ouKfKi1Z41x8dQ4LfP9NHGNc9Sccn8hqV3o1482D/6S:oJCi1Zue3LfPYc9ScuV3VDX

    Score
    10/10
    modiloaderpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Server Software Component: Terminal Services DLL

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Deletes itself

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks