Overview

overview

10

Static

static

10

d3b64a1819...18.exe

windows7-x64

10

d3b64a1819...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d3b64a1819b253bf5d35f05b0ba438a7_JaffaCakes118

  • Size

    273KB

  • Sample

    240908-gvpzss1ank

  • MD5

    d3b64a1819b253bf5d35f05b0ba438a7

  • SHA1

    e63739c35baf05ce6b59355baa36aff2a7a87066

  • SHA256

    3e086d60be1bd46ca8dcac5d7a1cfe797db3a8e3356e243a9ea3984dcc9662b4

  • SHA512

    71fcedaec16cc8e297a6a58a9929af86cc3d91ab218292282e7fee3e7403b39922f00c9b3f3ba637a3d3a6197ffea577b2832d806172f21039141ff23f84b3bb

  • SSDEEP

    6144:SGyjnBSkuV1d4eZd88ORJIf/wTB4W53Jpc:BYnBSkuVUeZdYqwTd

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      d3b64a1819b253bf5d35f05b0ba438a7_JaffaCakes118

    • Size

      273KB

    • MD5

      d3b64a1819b253bf5d35f05b0ba438a7

    • SHA1

      e63739c35baf05ce6b59355baa36aff2a7a87066

    • SHA256

      3e086d60be1bd46ca8dcac5d7a1cfe797db3a8e3356e243a9ea3984dcc9662b4

    • SHA512

      71fcedaec16cc8e297a6a58a9929af86cc3d91ab218292282e7fee3e7403b39922f00c9b3f3ba637a3d3a6197ffea577b2832d806172f21039141ff23f84b3bb

    • SSDEEP

      6144:SGyjnBSkuV1d4eZd88ORJIf/wTB4W53Jpc:BYnBSkuVUeZdYqwTd

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks