Overview

overview

10

Static

static

10

cd358113c2...18.exe

windows7-x64

10

cd358113c2...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd358113c2a1095c5d86634c91d9b2e6_JaffaCakes118

  • Size

    18KB

  • Sample

    240831-vetjyavdkc

  • MD5

    cd358113c2a1095c5d86634c91d9b2e6

  • SHA1

    0c3c9c98fc0032ee4a4c21ce040d1154e674d9f3

  • SHA256

    6752f81cfc66dff0df46e3f7bec3cbd3256613b3a9705afff82c8df5def58eb5

  • SHA512

    2afc2ff44c47b0972185a0b37311eec2f272049e4304c65e590d5659ca63d5a7a6047e6dc3ace278dd7216c977e55de3642bdf59496e9f7d6c70b651f668db23

  • SSDEEP

    384:LEw7wknHOYXQdhLGPvCaV4pLS7OGQ8xy1CzcZiqxne:LEw7wkHOYEGPvCaV4pLzb1fZi

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      cd358113c2a1095c5d86634c91d9b2e6_JaffaCakes118

    • Size

      18KB

    • MD5

      cd358113c2a1095c5d86634c91d9b2e6

    • SHA1

      0c3c9c98fc0032ee4a4c21ce040d1154e674d9f3

    • SHA256

      6752f81cfc66dff0df46e3f7bec3cbd3256613b3a9705afff82c8df5def58eb5

    • SHA512

      2afc2ff44c47b0972185a0b37311eec2f272049e4304c65e590d5659ca63d5a7a6047e6dc3ace278dd7216c977e55de3642bdf59496e9f7d6c70b651f668db23

    • SSDEEP

      384:LEw7wknHOYXQdhLGPvCaV4pLS7OGQ8xy1CzcZiqxne:LEw7wkHOYEGPvCaV4pLzb1fZi

    Score
    10/10
    modiloaderdiscoverypersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks