Overview

overview

10

Static

static

3

9655714118...18.exe

windows7-x64

10

9655714118...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    965571411865b1b8896623b7446e9fd5_JaffaCakes118

  • Size

    284KB

  • Sample

    240814-q15rwavglg

  • MD5

    965571411865b1b8896623b7446e9fd5

  • SHA1

    cb09af5e4b973418cd095aa10b5a1b5a305f4466

  • SHA256

    9c7a344153b741cf4b0a9bc3883cb7c8c36b7e8a6cd90f3bcd634ae1870107d0

  • SHA512

    ac4c7528551f968630233cf762a5fdac98de2fdaf5fc79efe27b1654b9c0da45b2f49c99b479d8debce599d4a282ed0fd561cf4c226994619eda08ddce67beba

  • SSDEEP

    6144:3dF9PEopC++PHSM+9jMQ82/YAoeIEAJm8xNjxqpTC+zj7XeqPmIgQoA06:3dF9PEcP+Py4j2/FoeIdJHyWeDPiN6

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      965571411865b1b8896623b7446e9fd5_JaffaCakes118

    • Size

      284KB

    • MD5

      965571411865b1b8896623b7446e9fd5

    • SHA1

      cb09af5e4b973418cd095aa10b5a1b5a305f4466

    • SHA256

      9c7a344153b741cf4b0a9bc3883cb7c8c36b7e8a6cd90f3bcd634ae1870107d0

    • SHA512

      ac4c7528551f968630233cf762a5fdac98de2fdaf5fc79efe27b1654b9c0da45b2f49c99b479d8debce599d4a282ed0fd561cf4c226994619eda08ddce67beba

    • SSDEEP

      6144:3dF9PEopC++PHSM+9jMQ82/YAoeIEAJm8xNjxqpTC+zj7XeqPmIgQoA06:3dF9PEcP+Py4j2/FoeIdJHyWeDPiN6

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks