Overview

overview

10

Static

static

7

5a8299e300...18.exe

windows7-x64

10

5a8299e300...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5a8299e300650b1a95afdea47d0a5182_JaffaCakes118

  • Size

    804KB

  • Sample

    240719-fcxq9awgja

  • MD5

    5a8299e300650b1a95afdea47d0a5182

  • SHA1

    fccc2b5e61c5b15657eadc64d1cef8933931a3fc

  • SHA256

    1e0d47b9dc5de946c95d81c458bdf224d8c9896d81dedaf6b551eb692ed9fcde

  • SHA512

    513d6e4366707f9532ae7a18245973e95d045f513e63d0247dc22573ac91311e51377100dfe44bc6b8b89c86ce4d0d217c5bf59a5a0e14989df94902667dfc3f

  • SSDEEP

    12288:ZeFzF6oScOO1rgJBwe79Bj/s527cSH4Es9z:ZOHd1rgJB1Hjk5Q54d9z

Score
10/10
modiloaderevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      5a8299e300650b1a95afdea47d0a5182_JaffaCakes118

    • Size

      804KB

    • MD5

      5a8299e300650b1a95afdea47d0a5182

    • SHA1

      fccc2b5e61c5b15657eadc64d1cef8933931a3fc

    • SHA256

      1e0d47b9dc5de946c95d81c458bdf224d8c9896d81dedaf6b551eb692ed9fcde

    • SHA512

      513d6e4366707f9532ae7a18245973e95d045f513e63d0247dc22573ac91311e51377100dfe44bc6b8b89c86ce4d0d217c5bf59a5a0e14989df94902667dfc3f

    • SSDEEP

      12288:ZeFzF6oScOO1rgJBwe79Bj/s527cSH4Es9z:ZOHd1rgJB1Hjk5Q54d9z

    Score
    10/10
    modiloaderevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks