Overview

overview

10

Static

static

3

e16091cdd2...18.exe

windows7-x64

10

e16091cdd2...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e16091cdd22110a7380abfdd07a21a60_JaffaCakes118

  • Size

    729KB

  • Sample

    240915-a6tc2awhjn

  • MD5

    e16091cdd22110a7380abfdd07a21a60

  • SHA1

    1861a01b76d2826b099c8f14bb948bd27674c67f

  • SHA256

    e21954aafd42bbb51bd7d5d98563f3115b24b8b254cb721b1c676ec4c3b89b5f

  • SHA512

    751f998f62a743ca02ce575c99ed5b8ebb15fe5cb1c0468dfbe310511e08b141e869b456cf1f2617b55594e30a97831345139969b10a648328df3833c2055905

  • SSDEEP

    12288:Hmmo7YNQzGnBaWnBsPDqWOFqetuiaSwXb0lvIfU+5wOAjIXIYh:GvwQyBaWnBCqyaaNCM2OAjEIk

Score
10/10
modiloaderdiscoveryevasiontrojanupx

Malware Config

Targets

    • Target

      e16091cdd22110a7380abfdd07a21a60_JaffaCakes118

    • Size

      729KB

    • MD5

      e16091cdd22110a7380abfdd07a21a60

    • SHA1

      1861a01b76d2826b099c8f14bb948bd27674c67f

    • SHA256

      e21954aafd42bbb51bd7d5d98563f3115b24b8b254cb721b1c676ec4c3b89b5f

    • SHA512

      751f998f62a743ca02ce575c99ed5b8ebb15fe5cb1c0468dfbe310511e08b141e869b456cf1f2617b55594e30a97831345139969b10a648328df3833c2055905

    • SSDEEP

      12288:Hmmo7YNQzGnBaWnBsPDqWOFqetuiaSwXb0lvIfU+5wOAjIXIYh:GvwQyBaWnBCqyaaNCM2OAjEIk

    Score
    10/10
    modiloaderdiscoveryevasiontrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks