Overview

overview

10

Static

static

3

e1317ffb51...18.exe

windows7-x64

10

e1317ffb51...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e1317ffb51838ea28a663b8608a94272_JaffaCakes118

  • Size

    683KB

  • Sample

    240914-2r7qna1fmb

  • MD5

    e1317ffb51838ea28a663b8608a94272

  • SHA1

    ae0b2f7872e42dca0928e95a4156c32bbe750b86

  • SHA256

    d3c4349112f3269e9fcb146ad34ec498c141eede2f8630ee05fb76c9c8f020fb

  • SHA512

    fc0787179a569d4e80c5485bc3038dd5c906205ec2703c81f1a2f4db0226e3c4f7016386d7e4214534d5419384d95afc9698c684e0fa7b0874bda183a34328fa

  • SSDEEP

    12288:MVnlC+/F7TegtMt0ReMKpqysHhhvOBoLF3Z4mxxHI80Uzl6wXMJMAEGH/cQ6ed/o:w1/F7TPtJe3sHhROBoLQmXo856cMdEiY

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      e1317ffb51838ea28a663b8608a94272_JaffaCakes118

    • Size

      683KB

    • MD5

      e1317ffb51838ea28a663b8608a94272

    • SHA1

      ae0b2f7872e42dca0928e95a4156c32bbe750b86

    • SHA256

      d3c4349112f3269e9fcb146ad34ec498c141eede2f8630ee05fb76c9c8f020fb

    • SHA512

      fc0787179a569d4e80c5485bc3038dd5c906205ec2703c81f1a2f4db0226e3c4f7016386d7e4214534d5419384d95afc9698c684e0fa7b0874bda183a34328fa

    • SSDEEP

      12288:MVnlC+/F7TegtMt0ReMKpqysHhhvOBoLF3Z4mxxHI80Uzl6wXMJMAEGH/cQ6ed/o:w1/F7TPtJe3sHhROBoLQmXo856cMdEiY

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks