Overview

overview

10

Static

static

3

df0e10451d...18.exe

windows7-x64

10

df0e10451d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    df0e10451d74d8b0f6dec9307b3af3e8_JaffaCakes118

  • Size

    98KB

  • Sample

    240913-2x153avakf

  • MD5

    df0e10451d74d8b0f6dec9307b3af3e8

  • SHA1

    7b37e201b9d7393b17a4476bead0e63dd4bb76fd

  • SHA256

    72683be5df459f9f67ee4cf9a670663166f0df7f72bb2bdf80ad459d52cc966e

  • SHA512

    d188330aad45c043074ca92ab873708d09a776fad18b16ad6074ae8dd35434c3404aeee8fb2359fee5e2a9b44a79bae9c21b56552c023adc6105a9350c8cae8b

  • SSDEEP

    3072:q3HnXCsf2Cp2GivcxwPnzEx6bfd7DmhqUxWs:CHnXTfv3gzEx6bVOzxF

Score
10/10
modiloaderdefense_evasiondiscoverytrojan

Malware Config

Targets

    • Target

      df0e10451d74d8b0f6dec9307b3af3e8_JaffaCakes118

    • Size

      98KB

    • MD5

      df0e10451d74d8b0f6dec9307b3af3e8

    • SHA1

      7b37e201b9d7393b17a4476bead0e63dd4bb76fd

    • SHA256

      72683be5df459f9f67ee4cf9a670663166f0df7f72bb2bdf80ad459d52cc966e

    • SHA512

      d188330aad45c043074ca92ab873708d09a776fad18b16ad6074ae8dd35434c3404aeee8fb2359fee5e2a9b44a79bae9c21b56552c023adc6105a9350c8cae8b

    • SSDEEP

      3072:q3HnXCsf2Cp2GivcxwPnzEx6bfd7DmhqUxWs:CHnXTfv3gzEx6bVOzxF

    Score
    10/10
    modiloaderdefense_evasiondiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks