Overview

overview

10

Static

static

10

e10bcf6b5e...18.exe

windows7-x64

10

e10bcf6b5e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e10bcf6b5e436eb96ad92ac2ef8317df_JaffaCakes118

  • Size

    282KB

  • Sample

    240914-z2w1ssxalb

  • MD5

    e10bcf6b5e436eb96ad92ac2ef8317df

  • SHA1

    bf87fb1f340d751d3ef183c98003903293a51052

  • SHA256

    5c2f653066d3a4e0ee0af293b9c3800220603e992a630e9181065aef7c2dc68e

  • SHA512

    8b1ffca777c01b4d3768cbcb394f7ec179d22d7cbd61d41f77d631ca765b741aa2a58634843b6dbee093d8591eefb540565a9b5f20434b49976a5d2cee236943

  • SSDEEP

    6144:w6LRwbLWfBuCFSvJBpuQiEdsgVwufvUkvKoC5BnQXjdU:TObHCFSvJBpDvG5zmq

Score
10/10
modiloaderdefense_evasiondiscoverypersistencetrojan

Malware Config

Targets

    • Target

      e10bcf6b5e436eb96ad92ac2ef8317df_JaffaCakes118

    • Size

      282KB

    • MD5

      e10bcf6b5e436eb96ad92ac2ef8317df

    • SHA1

      bf87fb1f340d751d3ef183c98003903293a51052

    • SHA256

      5c2f653066d3a4e0ee0af293b9c3800220603e992a630e9181065aef7c2dc68e

    • SHA512

      8b1ffca777c01b4d3768cbcb394f7ec179d22d7cbd61d41f77d631ca765b741aa2a58634843b6dbee093d8591eefb540565a9b5f20434b49976a5d2cee236943

    • SSDEEP

      6144:w6LRwbLWfBuCFSvJBpuQiEdsgVwufvUkvKoC5BnQXjdU:TObHCFSvJBpDvG5zmq

    Score
    10/10
    modiloaderdefense_evasiondiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks