Overview

overview

10

Static

static

10

d2ab0dd4e8...18.exe

windows7-x64

10

d2ab0dd4e8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d2ab0dd4e841d5ae967f173cf7b84c2c_JaffaCakes118

  • Size

    280KB

  • Sample

    240907-x47tzashjh

  • MD5

    d2ab0dd4e841d5ae967f173cf7b84c2c

  • SHA1

    96a17210f2404f0f39933c9bf6ed886805c89838

  • SHA256

    29897313c5509cbaf181e74f29209100d1ef8dc2d9ac9912baf055ecf53c3c48

  • SHA512

    dd4d28ea13838d4c7be9b165a6a2740aa865a256b90e44f6952bf81b07e651b2850870d490fb1d793ce84d72fa70ca950b5a02abf04897298ccb5fddf027a14c

  • SSDEEP

    3072:rO86IPZVbf8mMpML3A8XKzd9rpOiG3bwapcDebvVSQXMmdb2fDevpaHzbbr0Z:p6Irb0jQRaxCSaAEPMkAbbE

Score
10/10
modiloaderdiscoveryevasiontrojan

Malware Config

Targets

    • Target

      d2ab0dd4e841d5ae967f173cf7b84c2c_JaffaCakes118

    • Size

      280KB

    • MD5

      d2ab0dd4e841d5ae967f173cf7b84c2c

    • SHA1

      96a17210f2404f0f39933c9bf6ed886805c89838

    • SHA256

      29897313c5509cbaf181e74f29209100d1ef8dc2d9ac9912baf055ecf53c3c48

    • SHA512

      dd4d28ea13838d4c7be9b165a6a2740aa865a256b90e44f6952bf81b07e651b2850870d490fb1d793ce84d72fa70ca950b5a02abf04897298ccb5fddf027a14c

    • SSDEEP

      3072:rO86IPZVbf8mMpML3A8XKzd9rpOiG3bwapcDebvVSQXMmdb2fDevpaHzbbr0Z:p6Irb0jQRaxCSaAEPMkAbbE

    Score
    10/10
    modiloaderdiscoveryevasiontrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies firewall policy service

      evasion

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks