Overview

overview

10

Static

static

7

da1ea3d662...18.exe

windows7-x64

10

da1ea3d662...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    da1ea3d662072319b75a43f7d58f1813_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240911-l7zrzsvall

  • MD5

    da1ea3d662072319b75a43f7d58f1813

  • SHA1

    647db3a7faddf5269cf613385f708dc4e011315f

  • SHA256

    18eb8dc16ef23c3671af3a2dabeb339751c3e608451105810fa3be82525724d6

  • SHA512

    d1f5b3b5ab69e774afd65ffbe2d9bc0cfa61d81f6162602832e25da87703ece364e3b0287040ee5c7f647abdb7765173fc5c3e7a34b5113480f7a1d514d11b48

  • SSDEEP

    24576:WA/SB4iSIHvG8YQMqc+wfBF9Vd6JZgmtdlWn34EuCV3LjfgZz9t0f5CDQrFv:p/FgYQQXBvVd0FAfuY3ffgZz9SI8F

Score
10/10
modiloaderdiscoveryevasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      da1ea3d662072319b75a43f7d58f1813_JaffaCakes118

    • Size

      1.3MB

    • MD5

      da1ea3d662072319b75a43f7d58f1813

    • SHA1

      647db3a7faddf5269cf613385f708dc4e011315f

    • SHA256

      18eb8dc16ef23c3671af3a2dabeb339751c3e608451105810fa3be82525724d6

    • SHA512

      d1f5b3b5ab69e774afd65ffbe2d9bc0cfa61d81f6162602832e25da87703ece364e3b0287040ee5c7f647abdb7765173fc5c3e7a34b5113480f7a1d514d11b48

    • SSDEEP

      24576:WA/SB4iSIHvG8YQMqc+wfBF9Vd6JZgmtdlWn34EuCV3LjfgZz9t0f5CDQrFv:p/FgYQQXBvVd0FAfuY3ffgZz9SI8F

    Score
    10/10
    modiloaderdiscoveryevasionpersistencethemidatrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks