Overview

overview

10

Static

static

10

d9c6762464...18.exe

windows7-x64

10

d9c6762464...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d9c676246414b5c1211ce337b1e332b7_JaffaCakes118

  • Size

    105KB

  • Sample

    240911-g5a9dswgjm

  • MD5

    d9c676246414b5c1211ce337b1e332b7

  • SHA1

    64147ef6ed8c70fd5ceb25b194573c0f5729f8bf

  • SHA256

    603e2b74c02fc34942f234a2e600be53d828698f0fce8ced123c0a9570568758

  • SHA512

    c33a18447c7b46b1f06b4d4757e2e7e2e618f10ece3278395fd7c471f7d29d38892037c4d8002f94c090eb304b830b4db11177eebb940bc07d1904a6a58c3650

  • SSDEEP

    1536:XCGcRjbb53/KCY3L3RiAfLiZaK+QGY50I1HUMFyq6DmF9HRKw+gj:cl3/VefLibrP1H5yTC1RKCj

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      d9c676246414b5c1211ce337b1e332b7_JaffaCakes118

    • Size

      105KB

    • MD5

      d9c676246414b5c1211ce337b1e332b7

    • SHA1

      64147ef6ed8c70fd5ceb25b194573c0f5729f8bf

    • SHA256

      603e2b74c02fc34942f234a2e600be53d828698f0fce8ced123c0a9570568758

    • SHA512

      c33a18447c7b46b1f06b4d4757e2e7e2e618f10ece3278395fd7c471f7d29d38892037c4d8002f94c090eb304b830b4db11177eebb940bc07d1904a6a58c3650

    • SSDEEP

      1536:XCGcRjbb53/KCY3L3RiAfLiZaK+QGY50I1HUMFyq6DmF9HRKw+gj:cl3/VefLibrP1H5yTC1RKCj

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks