General

  • Target

    de24e797a50dcda6dea01c86ec642642_JaffaCakes118

  • Size

    108KB

  • Sample

    240913-ldzj5awdjp

  • MD5

    de24e797a50dcda6dea01c86ec642642

  • SHA1

    65e06222e1ecfba1ea340d1a9354783b61864f29

  • SHA256

    7f96b6171265616445252e14ba895c8f8794252fb5be336456f91502d8472b2c

  • SHA512

    554c87616ab3bff635030bd22b35d8c307d1666a3d8abb79aa16ec173f1d7e483d95163c2eee44ed58d049d2196760e28efa9b3780eae301d395426cf888d654

  • SSDEEP

    1536:UVuNAXTj4Fj/91/NnLZqeWEPVpa8DzePjkgcwYS7S5+Vfk09+26n4t4n06cnouy8:yoy8j7VnNdrPHaSekwi+mW+2Q068out

Malware Config

Targets

    • Target

      de24e797a50dcda6dea01c86ec642642_JaffaCakes118

    • Size

      108KB

    • MD5

      de24e797a50dcda6dea01c86ec642642

    • SHA1

      65e06222e1ecfba1ea340d1a9354783b61864f29

    • SHA256

      7f96b6171265616445252e14ba895c8f8794252fb5be336456f91502d8472b2c

    • SHA512

      554c87616ab3bff635030bd22b35d8c307d1666a3d8abb79aa16ec173f1d7e483d95163c2eee44ed58d049d2196760e28efa9b3780eae301d395426cf888d654

    • SSDEEP

      1536:UVuNAXTj4Fj/91/NnLZqeWEPVpa8DzePjkgcwYS7S5+Vfk09+26n4t4n06cnouy8:yoy8j7VnNdrPHaSekwi+mW+2Q068out

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • UAC bypass

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks