Overview

overview

10

Static

static

10

402132dbbf...18.exe

windows7-x64

10

402132dbbf...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    402132dbbfad60be7154935df4c41e21_JaffaCakes118

  • Size

    448KB

  • Sample

    240713-enyl9axdqf

  • MD5

    402132dbbfad60be7154935df4c41e21

  • SHA1

    acc73ea7e9b77fd340609287cb5d2610a4f885b2

  • SHA256

    db0271dfd6366e57f575d99d9421476906ded37927b9a98b6d8fa60efbd3a964

  • SHA512

    59813e3e5720a468f20c34e0c1907b0a2ba197b75dc44f8d3aa6f4ff5c47d0fd3370d166c387e224fc6307da58fa3805032609d3b00174eafb7eb813f398ccea

  • SSDEEP

    6144:66In+aCDtzm5kT04/Dw6rquXDPLEFlwvZT/2mhrGT9M40hAbbn:qhkT04E6l4wpXcT0i

Score
10/10
modiloaderevasiontrojan

Malware Config

Targets

    • Target

      402132dbbfad60be7154935df4c41e21_JaffaCakes118

    • Size

      448KB

    • MD5

      402132dbbfad60be7154935df4c41e21

    • SHA1

      acc73ea7e9b77fd340609287cb5d2610a4f885b2

    • SHA256

      db0271dfd6366e57f575d99d9421476906ded37927b9a98b6d8fa60efbd3a964

    • SHA512

      59813e3e5720a468f20c34e0c1907b0a2ba197b75dc44f8d3aa6f4ff5c47d0fd3370d166c387e224fc6307da58fa3805032609d3b00174eafb7eb813f398ccea

    • SSDEEP

      6144:66In+aCDtzm5kT04/Dw6rquXDPLEFlwvZT/2mhrGT9M40hAbbn:qhkT04E6l4wpXcT0i

    Score
    10/10
    modiloaderevasiontrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies firewall policy service

      evasion

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks