Overview

overview

10

Static

static

3

e6a54c05b1...18.exe

windows7-x64

10

e6a54c05b1...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e6a54c05b16d01d85e44fc7fce7dd765_JaffaCakes118

  • Size

    392KB

  • Sample

    240917-mskj7aydpb

  • MD5

    e6a54c05b16d01d85e44fc7fce7dd765

  • SHA1

    bb8f63b3ebfbbdd32417264e5aa887276d66aa19

  • SHA256

    b0f2aef8417cdcc87ffc09a1fd416285ec7ff34180721b7be3ae1b829e4561df

  • SHA512

    4b8279cf6e41f0d0b1fefaed205e2a9fcb47f302bb97ba499895744354b9e59d62e8478f223fe4e17d5fb0a841ea3c07ea2264299d5395ac802302fffe3d0cc3

  • SSDEEP

    6144:xbHs9nymZhqg4Cq0Kwo8uBwfL0dnJg50hjkgELXfOm:9HsVwg4Cewo/efL01JiSjk7LXP

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      e6a54c05b16d01d85e44fc7fce7dd765_JaffaCakes118

    • Size

      392KB

    • MD5

      e6a54c05b16d01d85e44fc7fce7dd765

    • SHA1

      bb8f63b3ebfbbdd32417264e5aa887276d66aa19

    • SHA256

      b0f2aef8417cdcc87ffc09a1fd416285ec7ff34180721b7be3ae1b829e4561df

    • SHA512

      4b8279cf6e41f0d0b1fefaed205e2a9fcb47f302bb97ba499895744354b9e59d62e8478f223fe4e17d5fb0a841ea3c07ea2264299d5395ac802302fffe3d0cc3

    • SSDEEP

      6144:xbHs9nymZhqg4Cq0Kwo8uBwfL0dnJg50hjkgELXfOm:9HsVwg4Cewo/efL01JiSjk7LXP

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks