Overview

overview

10

Static

static

3

a61a192b46...18.exe

windows7-x64

10

a61a192b46...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a61a192b466f1b3daadcd8c686004ece_JaffaCakes118

  • Size

    592KB

  • Sample

    240818-kkbwzayapj

  • MD5

    a61a192b466f1b3daadcd8c686004ece

  • SHA1

    bc0ab6a4620c3e3061545ee0ef3f0689c5247d0d

  • SHA256

    bced7f3923fe48e4ef6dceaf25639a7ae0320bf809e4484eceaa089f0455a676

  • SHA512

    ed71078ac802771b3533287d1aed7c30c29bcfad05f8a09db2a91944562c66e6f00f701e5d0b46789aa10df178e01293ae75503a94744b8815c0a6c753edddc3

  • SSDEEP

    12288:C4x6OMDy+NI4KLEZWpKF3Z4mxxDOuRrqIs8z2Kv:C06L+at8qQmXDOWrqtMv

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      a61a192b466f1b3daadcd8c686004ece_JaffaCakes118

    • Size

      592KB

    • MD5

      a61a192b466f1b3daadcd8c686004ece

    • SHA1

      bc0ab6a4620c3e3061545ee0ef3f0689c5247d0d

    • SHA256

      bced7f3923fe48e4ef6dceaf25639a7ae0320bf809e4484eceaa089f0455a676

    • SHA512

      ed71078ac802771b3533287d1aed7c30c29bcfad05f8a09db2a91944562c66e6f00f701e5d0b46789aa10df178e01293ae75503a94744b8815c0a6c753edddc3

    • SSDEEP

      12288:C4x6OMDy+NI4KLEZWpKF3Z4mxxDOuRrqIs8z2Kv:C06L+at8qQmXDOWrqtMv

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks