Overview

overview

10

Static

static

10

daa04d8ece...18.exe

windows7-x64

10

daa04d8ece...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    daa04d8eced64e27c5453db3084bf6e7_JaffaCakes118

  • Size

    886KB

  • Sample

    240911-sl1kqaxgna

  • MD5

    daa04d8eced64e27c5453db3084bf6e7

  • SHA1

    8fd338b7c660429db631763c7c4e03a4982edaac

  • SHA256

    61202a7384e03ce735633ff56b7414f3685666548d9acda67b2d7d502a0a488e

  • SHA512

    133cda2ed5efe701dce424869821de31759e523cef2af4a0278ac92aefb75f21e65beea570d2de22418f7abc85eedff9c0117b3e73396d77ea3daddb5f6df4eb

  • SSDEEP

    24576:YS2Vp6RwTk9IBc8AsIKv6ysCLz4zF53c:ip6STRBcDKySnGc

Score
10/10
modiloaderdiscoveryevasiontrojan

Malware Config

Targets

    • Target

      daa04d8eced64e27c5453db3084bf6e7_JaffaCakes118

    • Size

      886KB

    • MD5

      daa04d8eced64e27c5453db3084bf6e7

    • SHA1

      8fd338b7c660429db631763c7c4e03a4982edaac

    • SHA256

      61202a7384e03ce735633ff56b7414f3685666548d9acda67b2d7d502a0a488e

    • SHA512

      133cda2ed5efe701dce424869821de31759e523cef2af4a0278ac92aefb75f21e65beea570d2de22418f7abc85eedff9c0117b3e73396d77ea3daddb5f6df4eb

    • SSDEEP

      24576:YS2Vp6RwTk9IBc8AsIKv6ysCLz4zF53c:ip6STRBcDKySnGc

    Score
    10/10
    modiloaderdiscoveryevasiontrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • ModiLoader Second Stage

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks