General

  • Target

    d812c90d210d3ceeaef2190278aa5dc5_JaffaCakes118

  • Size

    63KB

  • Sample

    240910-mff18syfmj

  • MD5

    d812c90d210d3ceeaef2190278aa5dc5

  • SHA1

    533f108b92a52d9244c51569519902cba58cfa96

  • SHA256

    4e3704aa3b9bdd00989bbf7f42389095bb2447f572493c4249c8a59e6f58ddc8

  • SHA512

    ba17cd03b75bb53c2cc8f59dbd2def89cf88374dd5212bea9570669170615bc6996f49da451641f6eb62c1eb1357454a4b0043b5d4a57c035330ef25fcbd7e64

  • SSDEEP

    768:8wwyxQoQEWjSHD23fbU50aaaxwdYzsRew8rt9p1ePCJ3zrY9KxMP9Yw17G2aDWHP:pijqi5axwdcPptRQBPf7qyS3DLMxxb3

Malware Config

Targets

    • Target

      d812c90d210d3ceeaef2190278aa5dc5_JaffaCakes118

    • Size

      63KB

    • MD5

      d812c90d210d3ceeaef2190278aa5dc5

    • SHA1

      533f108b92a52d9244c51569519902cba58cfa96

    • SHA256

      4e3704aa3b9bdd00989bbf7f42389095bb2447f572493c4249c8a59e6f58ddc8

    • SHA512

      ba17cd03b75bb53c2cc8f59dbd2def89cf88374dd5212bea9570669170615bc6996f49da451641f6eb62c1eb1357454a4b0043b5d4a57c035330ef25fcbd7e64

    • SSDEEP

      768:8wwyxQoQEWjSHD23fbU50aaaxwdYzsRew8rt9p1ePCJ3zrY9KxMP9Yw17G2aDWHP:pijqi5axwdcPptRQBPf7qyS3DLMxxb3

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • ModiLoader Second Stage

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks