Overview

overview

10

Static

static

3

e225aa6671...18.exe

windows7-x64

10

e225aa6671...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e225aa6671275180db68bb3a7cead565_JaffaCakes118

  • Size

    552KB

  • Sample

    240915-k5f2eswcmb

  • MD5

    e225aa6671275180db68bb3a7cead565

  • SHA1

    985cd135cee732998de9e1a76be6bc733770ce2d

  • SHA256

    e9923f65899b466fd486bf3305e9dc8ed21eaa169ecdd81d495074f78f7542ae

  • SHA512

    29d08c0b7f30229cfe176e2b12c23c5602d4141d73167f840f98a34092ab4e749823d9751ca4a0b5b425e33f2eb3a2a0620fa68f47b8d6ca5e4bd33f415e373d

  • SSDEEP

    12288:fFQLq64CoTNBIT5DHg7g6skZBVgFHFTEyf25d:tQ0

Score
10/10
modiloaderdiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      e225aa6671275180db68bb3a7cead565_JaffaCakes118

    • Size

      552KB

    • MD5

      e225aa6671275180db68bb3a7cead565

    • SHA1

      985cd135cee732998de9e1a76be6bc733770ce2d

    • SHA256

      e9923f65899b466fd486bf3305e9dc8ed21eaa169ecdd81d495074f78f7542ae

    • SHA512

      29d08c0b7f30229cfe176e2b12c23c5602d4141d73167f840f98a34092ab4e749823d9751ca4a0b5b425e33f2eb3a2a0620fa68f47b8d6ca5e4bd33f415e373d

    • SSDEEP

      12288:fFQLq64CoTNBIT5DHg7g6skZBVgFHFTEyf25d:tQ0

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks