Overview

overview

10

Static

static

3

cebe6296a9...18.exe

windows7-x64

10

cebe6296a9...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cebe6296a952a4fa392e58fdcd2cc365_JaffaCakes118

  • Size

    311KB

  • Sample

    240906-fv31zsyckh

  • MD5

    cebe6296a952a4fa392e58fdcd2cc365

  • SHA1

    b04f882d8ad03f9a2a2d54ff20a6e81157e97ae4

  • SHA256

    3b375e9ded185d29a9acd217813aac2a41f17f3c61f8c602a56220e33e5f2c9d

  • SHA512

    d59d2923122a362510a749c58ef2c707ef5b6836eecc193da074612aee5ab3c8b8a7659067a76693295e6200f7fc148110bdc51f85f6bc95a87c8045edffa7af

  • SSDEEP

    6144:GOf/d1ic0PCFDLCOlWcfDWY+cCvyomxWi4joxRYgHlVV+CIKnz1f:GOf/7rhcKmoYjw7V+rY

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      cebe6296a952a4fa392e58fdcd2cc365_JaffaCakes118

    • Size

      311KB

    • MD5

      cebe6296a952a4fa392e58fdcd2cc365

    • SHA1

      b04f882d8ad03f9a2a2d54ff20a6e81157e97ae4

    • SHA256

      3b375e9ded185d29a9acd217813aac2a41f17f3c61f8c602a56220e33e5f2c9d

    • SHA512

      d59d2923122a362510a749c58ef2c707ef5b6836eecc193da074612aee5ab3c8b8a7659067a76693295e6200f7fc148110bdc51f85f6bc95a87c8045edffa7af

    • SSDEEP

      6144:GOf/d1ic0PCFDLCOlWcfDWY+cCvyomxWi4joxRYgHlVV+CIKnz1f:GOf/7rhcKmoYjw7V+rY

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks