Overview

overview

10

Static

static

7

cde4ca1cb9...18.exe

windows7-x64

10

cde4ca1cb9...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cde4ca1cb92889590d0841ecfa485717_JaffaCakes118

  • Size

    1.4MB

  • Sample

    240901-a1m9tsvfkd

  • MD5

    cde4ca1cb92889590d0841ecfa485717

  • SHA1

    ba484d842942bbe741e073d1e9ebf6c6b03fbccb

  • SHA256

    972272095dfe883ea755e86b2daa6318a4f6a898fc8373b6b0ca0b4ae4c2d0af

  • SHA512

    bdbfa3161b2a1fdfe66652f8cd133e3ed52a457f5c408b81ef773aa4ae6bd84988c420407aa339282f3789f284e845cc7e70591149ac4cd47d93d7f8899130d7

  • SSDEEP

    24576:lux0Mymnqwex2CVA2OaYr//r5thtsz+0u7T537b8NvVc5w:wuqnOx28OaYzdthtsUl7b2h

Score
10/10
modiloaderdiscoveryevasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      cde4ca1cb92889590d0841ecfa485717_JaffaCakes118

    • Size

      1.4MB

    • MD5

      cde4ca1cb92889590d0841ecfa485717

    • SHA1

      ba484d842942bbe741e073d1e9ebf6c6b03fbccb

    • SHA256

      972272095dfe883ea755e86b2daa6318a4f6a898fc8373b6b0ca0b4ae4c2d0af

    • SHA512

      bdbfa3161b2a1fdfe66652f8cd133e3ed52a457f5c408b81ef773aa4ae6bd84988c420407aa339282f3789f284e845cc7e70591149ac4cd47d93d7f8899130d7

    • SSDEEP

      24576:lux0Mymnqwex2CVA2OaYr//r5thtsz+0u7T537b8NvVc5w:wuqnOx28OaYzdthtsUl7b2h

    Score
    10/10
    modiloaderdiscoveryevasionpersistencethemidatrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks