Overview

overview

10

Static

static

10

cf46175dba...18.exe

windows7-x64

10

cf46175dba...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cf46175dbaa28f85b0197a5b351bfa91_JaffaCakes118

  • Size

    132KB

  • Sample

    240906-lxg47azfph

  • MD5

    cf46175dbaa28f85b0197a5b351bfa91

  • SHA1

    eac98b5b5730c55fe43bd3b4535d1ebc79e654d4

  • SHA256

    1daf582e2b920ae25107fbce2288c2c6992e907be78966c69aa806aba4a51fb6

  • SHA512

    f00cb1275d969b08d6926250a311025e04f11b4478fbaccfcfe05c400f9660e6225c347d7b78f82259e659e0178b5875c1456d6055695a009d7ce57d2f87a0ba

  • SSDEEP

    1536:TXfPAvzZEF28e6goZJpMRelkdXbvr2gbfT5D0Zwnd43oNhgWbNz/RNxpNoTvXQw+:TyzQc9ozpMjdrjlbTPJlNxpNop

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      cf46175dbaa28f85b0197a5b351bfa91_JaffaCakes118

    • Size

      132KB

    • MD5

      cf46175dbaa28f85b0197a5b351bfa91

    • SHA1

      eac98b5b5730c55fe43bd3b4535d1ebc79e654d4

    • SHA256

      1daf582e2b920ae25107fbce2288c2c6992e907be78966c69aa806aba4a51fb6

    • SHA512

      f00cb1275d969b08d6926250a311025e04f11b4478fbaccfcfe05c400f9660e6225c347d7b78f82259e659e0178b5875c1456d6055695a009d7ce57d2f87a0ba

    • SSDEEP

      1536:TXfPAvzZEF28e6goZJpMRelkdXbvr2gbfT5D0Zwnd43oNhgWbNz/RNxpNoTvXQw+:TyzQc9ozpMjdrjlbTPJlNxpNop

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks