Overview

overview

10

Static

static

3

e2aae49b4f...18.exe

windows7-x64

10

e2aae49b4f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e2aae49b4fec7654666e449a9e715a7b_JaffaCakes118

  • Size

    506KB

  • Sample

    240915-rhj8wsxapc

  • MD5

    e2aae49b4fec7654666e449a9e715a7b

  • SHA1

    6449ef425f8b756b882a402607fc3b78b1624b6c

  • SHA256

    fc5a28874f895d949ab0399f405adab985c90a5bd89dc1b78df86ff258836048

  • SHA512

    495c1690126e876645f3a369c38d9bce7e939253c9fd3c135ae8a86c9699d2e2f62525e16f4523e0275d746bf4872f9968b6dc03d6e2265ddbbe7665e200e4b3

  • SSDEEP

    12288:F4/Pfg6oj5BKTM7IF3Z4mxxCfS8ZULahN:FyPVqBKGIQmXyS802N

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      e2aae49b4fec7654666e449a9e715a7b_JaffaCakes118

    • Size

      506KB

    • MD5

      e2aae49b4fec7654666e449a9e715a7b

    • SHA1

      6449ef425f8b756b882a402607fc3b78b1624b6c

    • SHA256

      fc5a28874f895d949ab0399f405adab985c90a5bd89dc1b78df86ff258836048

    • SHA512

      495c1690126e876645f3a369c38d9bce7e939253c9fd3c135ae8a86c9699d2e2f62525e16f4523e0275d746bf4872f9968b6dc03d6e2265ddbbe7665e200e4b3

    • SSDEEP

      12288:F4/Pfg6oj5BKTM7IF3Z4mxxCfS8ZULahN:FyPVqBKGIQmXyS802N

    Score
    10/10
    modiloaderdiscoverypersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Server Software Component: Terminal Services DLL

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks