Overview

overview

10

Static

static

7

Lx_Speed 1...a1.exe

windows7-x64

10

Lx_Speed 1...a1.exe

windows10-2004-x64

10

破解补丁.exe

windows7-x64

7

破解补丁.exe

windows10-2004-x64

7

谷普下�...��.url

windows7-x64

1

谷普下�...��.url

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d5838ccc494cc1f65c185e97d963e00d_JaffaCakes118

  • Size

    3.7MB

  • Sample

    240909-cxhlaaxbqr

  • MD5

    d5838ccc494cc1f65c185e97d963e00d

  • SHA1

    f158b2ca7f16e29421b6bc51aab96a91afe0af42

  • SHA256

    5d9a2939956911726070916ac704888b2bdfdd7c739813d6bd3860e7b2c8c647

  • SHA512

    6fb106fb4ea297cc7548ee984eae9b293c2c6d3c28292ee94d574bb2011269feb710cd15db16965e4b4ee6789a4c1fbb3800b5b87165b07a9c6b9ccaa314f633

  • SSDEEP

    98304:fEruno+BXrEnnbnl1ulSa+S7MAeAw7MVL3r0E0GvB1:f6u7rkbnTnaLevMqna

Score
10/10
modiloaderdiscoverytrojanupxvmprotect

Malware Config

Targets

    • Target

      Lx_Speed 1.5 Beta1.exe

    • Size

      2.2MB

    • MD5

      d5fdd0a32bc734cc4abb7c39921c0051

    • SHA1

      cca76e39f9c9e7a9dbb4544b275669e297edc522

    • SHA256

      b3e4ec4f0233a46af22a024643deae26f6b1455b45dba5f5a3d6d59019a4b172

    • SHA512

      e354883e69d7d538a7c37042d1b1ebf7499b987dba4d0464da492f9f9963c646689b394c069abfeaabc2ced9818511dd51e5685e29adace962c969b43f03a7cf

    • SSDEEP

      49152:HeZ6epYyulT8r+d/PJOwKkfbPqm9QpDHfjuWULBtmQqvzUHe:HeseyvPJh9f2m9Q9HftULTmvvzUHe

    Score
    10/10
    modiloaderdiscoverytrojanupxvmprotect

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      破解补丁.exe

    • Size

      1.6MB

    • MD5

      e5c0784a64ca52c3e2c932b932d439e0

    • SHA1

      388ec842a606750f44def7b259d5bde604b34bfd

    • SHA256

      adcade3ecfd221bfbb5cb440a4bdaa58a9b00882c63bbe37192c37143bb69094

    • SHA512

      6f4f31669ef36aec896d62bcda06ad2a10b57593cd0c4dbfd62fc959df71e425c5354e6f43058b94a445c2e39f5d621a6528a42eefc5f4a8cced3e0802e5e93a

    • SSDEEP

      49152:kdr+P+HQihOWHXEN5sFHeJzHgvL86rdHRz:EwihfHUw1eJrgT8Y

    Score
    7/10
    discoveryupxvmprotect

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral3behavioral4

    • Target

      谷普下载-首页.url

    • Size

      343B

    • MD5

      b147aaed653a0b84fc9dc90d992f838f

    • SHA1

      2954923dadf00f3c09ba3f2133bd37b24ba2ee7f

    • SHA256

      41e497bbae7d9160c7523adf237e0456c47870bd8cd1ab2b4052f205db5cc5cb

    • SHA512

      f2930e7526280cb0f17469a8c8690220f107c36fff1a25d3d8746407301cbd149d7beb2be634a7d926471db69d5e20ea7d3733e993e4af9d80bbef1af4fa7a4f

    Score
    1/10
    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks