Overview

overview

10

Static

static

7

d945e8c210...18.exe

windows7-x64

10

d945e8c210...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d945e8c210a6b76a74afe06c67602db5_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240911-amt58atfjh

  • MD5

    d945e8c210a6b76a74afe06c67602db5

  • SHA1

    8f98268e55a29a0892c1b174136466d63421ace4

  • SHA256

    2fbfe7954ec76800df989990689a893ce9aaa4c016fe5b523c9590e7911a22f8

  • SHA512

    e45050699f6e8d3928231fa53c7601ccbebf116cf0c85f8253e33690de88fd92be4e3f47ff0d4232b1520cc91bdf6d25d068d8b04cd62db69ba3e8e6b0d545bc

  • SSDEEP

    24576:rpQbp77aZS0pqpYXORVqgiFF3JRbq1m99dTkIY9vQ:w42YtgibLbq1m97TBSvQ

Score
10/10
modiloaderdiscoveryevasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      d945e8c210a6b76a74afe06c67602db5_JaffaCakes118

    • Size

      1.3MB

    • MD5

      d945e8c210a6b76a74afe06c67602db5

    • SHA1

      8f98268e55a29a0892c1b174136466d63421ace4

    • SHA256

      2fbfe7954ec76800df989990689a893ce9aaa4c016fe5b523c9590e7911a22f8

    • SHA512

      e45050699f6e8d3928231fa53c7601ccbebf116cf0c85f8253e33690de88fd92be4e3f47ff0d4232b1520cc91bdf6d25d068d8b04cd62db69ba3e8e6b0d545bc

    • SSDEEP

      24576:rpQbp77aZS0pqpYXORVqgiFF3JRbq1m99dTkIY9vQ:w42YtgibLbq1m97TBSvQ

    Score
    10/10
    modiloaderdiscoveryevasionpersistencethemidatrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks