Overview

overview

10

Static

static

7

e4477efdd1...18.exe

windows7-x64

10

e4477efdd1...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e4477efdd16cd7ef8ed8e7de8885a7b2_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240916-h963asvhpl

  • MD5

    e4477efdd16cd7ef8ed8e7de8885a7b2

  • SHA1

    eb78f31b0a0c7d33e35d20ddc48499da4bf1249d

  • SHA256

    db8d280b47e7b5308a68de1b3025e5171c890e6a6598a3a13e5638a812baaf66

  • SHA512

    18afd4c4efe5d6393b4350357692442b0e15ce4c62c4e0985844ce6df9321665b33c7ceb37e1bccd4b7d25f191f087fb3535f0953eb9692b8a729f82293d2fd1

  • SSDEEP

    24576:Baz5NMYN5gjGy2nfHYyA3Ro1SIE94LLz84L2yrvx/CDnkt2IgoU2HpS3Mx3+GW:BaFNMYNuj9K2o109SLAS2yrvx/WkE8V+

Score
10/10
modiloaderdiscoveryevasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      e4477efdd16cd7ef8ed8e7de8885a7b2_JaffaCakes118

    • Size

      1.3MB

    • MD5

      e4477efdd16cd7ef8ed8e7de8885a7b2

    • SHA1

      eb78f31b0a0c7d33e35d20ddc48499da4bf1249d

    • SHA256

      db8d280b47e7b5308a68de1b3025e5171c890e6a6598a3a13e5638a812baaf66

    • SHA512

      18afd4c4efe5d6393b4350357692442b0e15ce4c62c4e0985844ce6df9321665b33c7ceb37e1bccd4b7d25f191f087fb3535f0953eb9692b8a729f82293d2fd1

    • SSDEEP

      24576:Baz5NMYN5gjGy2nfHYyA3Ro1SIE94LLz84L2yrvx/CDnkt2IgoU2HpS3Mx3+GW:BaFNMYNuj9K2o109SLAS2yrvx/WkE8V+

    Score
    10/10
    modiloaderdiscoveryevasionpersistencethemidatrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks