Overview

overview

10

Static

static

3

d902271006...18.exe

windows7-x64

10

d902271006...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d902271006e9d8143304aee49adcf2f1_JaffaCakes118

  • Size

    337KB

  • Sample

    240910-zejf7awakg

  • MD5

    d902271006e9d8143304aee49adcf2f1

  • SHA1

    0a338bf99320e2613c91c6cb78fe7ffbf3fe885e

  • SHA256

    1728f7ecd56e74100f21a9d28c878d9fad969f2b141d2d4acafd62e012d69d57

  • SHA512

    f3ed35720e3a88f038b5e557443078cc2d2cc43dad6452deca2dcec35f8a5c710230d2d5a05cbafb32efc8808bba4eba8bd4602cb858ab51f5e5cd64989083c0

  • SSDEEP

    6144:X0kxLucQYBVNnFl7qA7bFtHj5YUqsxbMYayGAwuhnpJvmKhdPs2viVtdol+D6m+l:EkxLP9BVtF1qAv3GZKzajYvmONsnVa+c

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      d902271006e9d8143304aee49adcf2f1_JaffaCakes118

    • Size

      337KB

    • MD5

      d902271006e9d8143304aee49adcf2f1

    • SHA1

      0a338bf99320e2613c91c6cb78fe7ffbf3fe885e

    • SHA256

      1728f7ecd56e74100f21a9d28c878d9fad969f2b141d2d4acafd62e012d69d57

    • SHA512

      f3ed35720e3a88f038b5e557443078cc2d2cc43dad6452deca2dcec35f8a5c710230d2d5a05cbafb32efc8808bba4eba8bd4602cb858ab51f5e5cd64989083c0

    • SSDEEP

      6144:X0kxLucQYBVNnFl7qA7bFtHj5YUqsxbMYayGAwuhnpJvmKhdPs2viVtdol+D6m+l:EkxLP9BVtF1qAv3GZKzajYvmONsnVa+c

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks