Overview

overview

10

Static

static

3

b2852337c4...18.exe

windows7-x64

10

b2852337c4...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b2852337c4241bee8173263afff3dfdc_JaffaCakes118

  • Size

    143KB

  • Sample

    240821-htqqdayfmj

  • MD5

    b2852337c4241bee8173263afff3dfdc

  • SHA1

    85bbc2c7263f511e80493a86c55cd9cf9d6233de

  • SHA256

    d8a9d03cb24e3a44b303bb06bb802165462a5ad54747e785816244874806a5f8

  • SHA512

    30cc1da52fd9b122166c9b464b85d826bae9061d8df9788e302668ee5e02fcf2d808a817cb095f92b3cd4aafa8cfa7619138d919879c6cb5d4c19e8459e11c8f

  • SSDEEP

    3072:0FHyP0szpfOQ5wNm2qH4CNiQOZkFqoXx6OuRAEnuyQelZABLF:i00s9Bw3m43QktoXxBuWEoelW5

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      b2852337c4241bee8173263afff3dfdc_JaffaCakes118

    • Size

      143KB

    • MD5

      b2852337c4241bee8173263afff3dfdc

    • SHA1

      85bbc2c7263f511e80493a86c55cd9cf9d6233de

    • SHA256

      d8a9d03cb24e3a44b303bb06bb802165462a5ad54747e785816244874806a5f8

    • SHA512

      30cc1da52fd9b122166c9b464b85d826bae9061d8df9788e302668ee5e02fcf2d808a817cb095f92b3cd4aafa8cfa7619138d919879c6cb5d4c19e8459e11c8f

    • SSDEEP

      3072:0FHyP0szpfOQ5wNm2qH4CNiQOZkFqoXx6OuRAEnuyQelZABLF:i00s9Bw3m43QktoXxBuWEoelW5

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks