Overview

overview

10

Static

static

10

5b4803a3f9...18.exe

windows7-x64

10

5b4803a3f9...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5b4803a3f943be466d1c76e19799544d_JaffaCakes118

  • Size

    272KB

  • Sample

    240719-k2qrfsshll

  • MD5

    5b4803a3f943be466d1c76e19799544d

  • SHA1

    2f0084275c0d79a4c8abd6b6f534b711915b6b97

  • SHA256

    cb666085976ec97ff0e6be77d35191cf9b15facbb62ab8426c40d0ecdc6d3204

  • SHA512

    1247d27f62c8090865757b2abb880caebef1255323ee50e0ce70a05a3f6d020ff6259ab20813ff07ea46e0ef1fb3fc63b2971fe6939a4869e39586836b0ec3eb

  • SSDEEP

    6144:kG377xS2Vp2CeiorXdwTBgWx4p53cpcCJJvHB:fr7xS2Vp6RwTyC/bJJvHB

Score
10/10
modiloaderevasionpersistencetrojan

Malware Config

Targets

    • Target

      5b4803a3f943be466d1c76e19799544d_JaffaCakes118

    • Size

      272KB

    • MD5

      5b4803a3f943be466d1c76e19799544d

    • SHA1

      2f0084275c0d79a4c8abd6b6f534b711915b6b97

    • SHA256

      cb666085976ec97ff0e6be77d35191cf9b15facbb62ab8426c40d0ecdc6d3204

    • SHA512

      1247d27f62c8090865757b2abb880caebef1255323ee50e0ce70a05a3f6d020ff6259ab20813ff07ea46e0ef1fb3fc63b2971fe6939a4869e39586836b0ec3eb

    • SSDEEP

      6144:kG377xS2Vp2CeiorXdwTBgWx4p53cpcCJJvHB:fr7xS2Vp6RwTyC/bJJvHB

    Score
    10/10
    modiloaderevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks