Overview

overview

10

Static

static

3

db05434a95...18.exe

windows7-x64

10

db05434a95...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    db05434a95212d30788a4b503a24fd4d_JaffaCakes118

  • Size

    123KB

  • Sample

    240911-xm8d6sxcjn

  • MD5

    db05434a95212d30788a4b503a24fd4d

  • SHA1

    730f7ba53b8ef6c9beb6976fc0f35d396f26511e

  • SHA256

    7809f9e7e70a7bdda126027018c01deda74b134730245aee3faf87858c3e8b84

  • SHA512

    15209f1c321ecdf0b829b1d83373b0352b1fbeafde99b848b1b13062f312acfda3692912d16c9eb0bf8f9890d68e5bd1f0dcf31fa951d2a9006cced19f8e1d13

  • SSDEEP

    3072:cegIgnFxHlim02KxdaBA0QNTGvOuTB2/h8ZF:sISF5l702KxdHZhozTBj/

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      db05434a95212d30788a4b503a24fd4d_JaffaCakes118

    • Size

      123KB

    • MD5

      db05434a95212d30788a4b503a24fd4d

    • SHA1

      730f7ba53b8ef6c9beb6976fc0f35d396f26511e

    • SHA256

      7809f9e7e70a7bdda126027018c01deda74b134730245aee3faf87858c3e8b84

    • SHA512

      15209f1c321ecdf0b829b1d83373b0352b1fbeafde99b848b1b13062f312acfda3692912d16c9eb0bf8f9890d68e5bd1f0dcf31fa951d2a9006cced19f8e1d13

    • SSDEEP

      3072:cegIgnFxHlim02KxdaBA0QNTGvOuTB2/h8ZF:sISF5l702KxdHZhozTBj/

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks