Overview

overview

10

Static

static

10

b9d98e77be...18.exe

windows7-x64

10

b9d98e77be...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b9d98e77beb91f9c3a08f072981b59dc_JaffaCakes118

  • Size

    38KB

  • Sample

    240823-byz2aa1ckr

  • MD5

    b9d98e77beb91f9c3a08f072981b59dc

  • SHA1

    ce86a0be58e71762322e4a4d62faf93d249eee51

  • SHA256

    c156ad3adfcd4618a7f52602071af80a52c65d827d5f8be3043e5e6a4b454d2f

  • SHA512

    f4430727db3cda3933fd7f4b560c78dac2302b3b6ca37b7763446144dbaafcebf6e5d35564553974e1bf49a0cbf3a1c2d5243186c3c8a5f657e8ccb4a77251bf

  • SSDEEP

    768:mBycquQyb2sZvFUK0eLzjJyWM0/Kbe7mvCOL:DcquQGdU+Lz9MZAmK+

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      b9d98e77beb91f9c3a08f072981b59dc_JaffaCakes118

    • Size

      38KB

    • MD5

      b9d98e77beb91f9c3a08f072981b59dc

    • SHA1

      ce86a0be58e71762322e4a4d62faf93d249eee51

    • SHA256

      c156ad3adfcd4618a7f52602071af80a52c65d827d5f8be3043e5e6a4b454d2f

    • SHA512

      f4430727db3cda3933fd7f4b560c78dac2302b3b6ca37b7763446144dbaafcebf6e5d35564553974e1bf49a0cbf3a1c2d5243186c3c8a5f657e8ccb4a77251bf

    • SSDEEP

      768:mBycquQyb2sZvFUK0eLzjJyWM0/Kbe7mvCOL:DcquQGdU+Lz9MZAmK+

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks