Overview

overview

10

Static

static

3

6f5489fc15...18.exe

windows7-x64

10

6f5489fc15...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6f5489fc15a9fd82b7ad5151f14fe96c_JaffaCakes118

  • Size

    153KB

  • Sample

    240725-na81haycka

  • MD5

    6f5489fc15a9fd82b7ad5151f14fe96c

  • SHA1

    0c3f2e1db9a0e4b6ca19c749cf5011d41e365226

  • SHA256

    4a47ed37d3acb1f3fd5b927e15457c035814af75ef19ccdeadd1b0763e22a144

  • SHA512

    05b9af7ebca4e47a1dde898b739748bdda3dd9bafbd4f6322be26764018cb94b3c96818e5cf13132415dfc320377ab2bc7eada24e1bd7d1035a021875f2a9642

  • SSDEEP

    3072:N6I+7DO/cfMAxygsCe6cpNVW+C7vnjxphQGwd7+biDn2+EK/4R3jmc:N6jygMAx2CR01aH2DoLjmc

Score
10/10
modiloaderdefense_evasiondiscoverytrojanupx

Malware Config

Targets

    • Target

      6f5489fc15a9fd82b7ad5151f14fe96c_JaffaCakes118

    • Size

      153KB

    • MD5

      6f5489fc15a9fd82b7ad5151f14fe96c

    • SHA1

      0c3f2e1db9a0e4b6ca19c749cf5011d41e365226

    • SHA256

      4a47ed37d3acb1f3fd5b927e15457c035814af75ef19ccdeadd1b0763e22a144

    • SHA512

      05b9af7ebca4e47a1dde898b739748bdda3dd9bafbd4f6322be26764018cb94b3c96818e5cf13132415dfc320377ab2bc7eada24e1bd7d1035a021875f2a9642

    • SSDEEP

      3072:N6I+7DO/cfMAxygsCe6cpNVW+C7vnjxphQGwd7+biDn2+EK/4R3jmc:N6jygMAx2CR01aH2DoLjmc

    Score
    10/10
    modiloaderdefense_evasiondiscoverytrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks