Overview

overview

10

Static

static

10

e38fe16fc5...18.exe

windows7-x64

10

e38fe16fc5...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118

  • Size

    63KB

  • Sample

    240915-29f1naxdmf

  • MD5

    e38fe16fc51b3c42bef629ed62969f64

  • SHA1

    cf295c7d03811b12dd897d3d9e711525c97e7897

  • SHA256

    2aa84a58339db121008c76c2ce37839c11978f630ea862149d87339da0fb5e2f

  • SHA512

    47f60e9081a501d06cabc01f5fc8d4c3cfef75ca21d5ddab3e578a5375dc3aa458dcba8c1fef35ad4c414938ed64b881793df3994e6933c16b9a27ccc5719b86

  • SSDEEP

    1536:HJqEVsjMnWP8GfbqxlspHBhf07ZpJjOzov:VVUsWUHlmuZpks

Score
10/10
modiloaderdefense_evasiondiscoverypersistencetrojan

Malware Config

Targets

    • Target

      e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118

    • Size

      63KB

    • MD5

      e38fe16fc51b3c42bef629ed62969f64

    • SHA1

      cf295c7d03811b12dd897d3d9e711525c97e7897

    • SHA256

      2aa84a58339db121008c76c2ce37839c11978f630ea862149d87339da0fb5e2f

    • SHA512

      47f60e9081a501d06cabc01f5fc8d4c3cfef75ca21d5ddab3e578a5375dc3aa458dcba8c1fef35ad4c414938ed64b881793df3994e6933c16b9a27ccc5719b86

    • SSDEEP

      1536:HJqEVsjMnWP8GfbqxlspHBhf07ZpJjOzov:VVUsWUHlmuZpks

    Score
    10/10
    modiloaderdiscoverypersistencetrojandefense_evasion

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks