Overview

overview

10

Static

static

3

dec54a6048...18.exe

windows7-x64

10

dec54a6048...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dec54a604826272a144fb50eeae276bc_JaffaCakes118

  • Size

    442KB

  • Sample

    240913-yb432svgka

  • MD5

    dec54a604826272a144fb50eeae276bc

  • SHA1

    1f79da12b4d457ed0249be3b324f4a4ba6c0160c

  • SHA256

    6396b6899aa5aebfdfd081645cd48d0d158d444ebd15bce4696687bc34cfc6a1

  • SHA512

    1278d3c3655b4c53641d940ef82a5e55f78da80dfb28f07cffa02fd263149097c54fd8889dc7b65bc7557a79c59eaa5732b85c79c186d2dcded93c23f874c219

  • SSDEEP

    12288:uIZIJ8lG4lQ+AjrgHNasJ4iopDYU+lQ8FNrnslpRzBqcP:FZIJ8lG4WNg0iops/frEntP

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      dec54a604826272a144fb50eeae276bc_JaffaCakes118

    • Size

      442KB

    • MD5

      dec54a604826272a144fb50eeae276bc

    • SHA1

      1f79da12b4d457ed0249be3b324f4a4ba6c0160c

    • SHA256

      6396b6899aa5aebfdfd081645cd48d0d158d444ebd15bce4696687bc34cfc6a1

    • SHA512

      1278d3c3655b4c53641d940ef82a5e55f78da80dfb28f07cffa02fd263149097c54fd8889dc7b65bc7557a79c59eaa5732b85c79c186d2dcded93c23f874c219

    • SSDEEP

      12288:uIZIJ8lG4lQ+AjrgHNasJ4iopDYU+lQ8FNrnslpRzBqcP:FZIJ8lG4WNg0iops/frEntP

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks