Overview

overview

10

Static

static

7

d267527626...18.exe

windows7-x64

10

d267527626...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d2675276265f985c8cfeb14cca964886_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240907-vdwynsweje

  • MD5

    d2675276265f985c8cfeb14cca964886

  • SHA1

    6d54b113e5c2d301919e1083b914ba5c401613ad

  • SHA256

    ba350c1292049ba21b712f468c1baf911c9f945c33139cca207adce97510ee1d

  • SHA512

    61109eb2ac54406c328e9f5f3c10de95f32cee4cb30fd3f573d9309c37cbfb8d49ee549218fc257fa9325a6f91ecdffc295e512205c384246e9ff3f6d1433eed

  • SSDEEP

    24576:uYWhdjO/W2doCOCut7PhwLp0IqjmDWgxc8QkOY4adG0Cyu3HM8METdx16ENn:uY+8W7CoQNZzHOY4as0Cy5ETdJ

Score
10/10
modiloaderdiscoveryevasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      d2675276265f985c8cfeb14cca964886_JaffaCakes118

    • Size

      1.3MB

    • MD5

      d2675276265f985c8cfeb14cca964886

    • SHA1

      6d54b113e5c2d301919e1083b914ba5c401613ad

    • SHA256

      ba350c1292049ba21b712f468c1baf911c9f945c33139cca207adce97510ee1d

    • SHA512

      61109eb2ac54406c328e9f5f3c10de95f32cee4cb30fd3f573d9309c37cbfb8d49ee549218fc257fa9325a6f91ecdffc295e512205c384246e9ff3f6d1433eed

    • SSDEEP

      24576:uYWhdjO/W2doCOCut7PhwLp0IqjmDWgxc8QkOY4adG0Cyu3HM8METdx16ENn:uY+8W7CoQNZzHOY4as0Cy5ETdJ

    Score
    10/10
    modiloaderdiscoveryevasionpersistencethemidatrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks