Overview

overview

10

Static

static

10

e712cfcde0...18.exe

windows7-x64

10

e712cfcde0...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e712cfcde0da6e1fd8b5bf7dd5d5c805_JaffaCakes118

  • Size

    328KB

  • Sample

    240917-sb3x4azarl

  • MD5

    e712cfcde0da6e1fd8b5bf7dd5d5c805

  • SHA1

    1e0ed37f52b5f1c28187e64d893f0d27fe3c04ec

  • SHA256

    62defdd68cd73b06364ce453c37c1a6523848f660fcb04cd40b47f9218e52420

  • SHA512

    ef263be24b9b3b2cd069830a3df9833e4ff7d41d1a543535690ed76a5e6f60f816c8dd7a6148638dd92c4683c4367d92917ff7e19f79d377848af93a62c0680f

  • SSDEEP

    6144:UvSdpSrgpHnaZa4SmVbloxSaHva8rOpsjp86w1AgvP8hMfUKf8p:UvSS8Sa4vrZajlZwBPbQ

Score
10/10
modiloaderdiscoverytrojanupx

Malware Config

Targets

    • Target

      e712cfcde0da6e1fd8b5bf7dd5d5c805_JaffaCakes118

    • Size

      328KB

    • MD5

      e712cfcde0da6e1fd8b5bf7dd5d5c805

    • SHA1

      1e0ed37f52b5f1c28187e64d893f0d27fe3c04ec

    • SHA256

      62defdd68cd73b06364ce453c37c1a6523848f660fcb04cd40b47f9218e52420

    • SHA512

      ef263be24b9b3b2cd069830a3df9833e4ff7d41d1a543535690ed76a5e6f60f816c8dd7a6148638dd92c4683c4367d92917ff7e19f79d377848af93a62c0680f

    • SSDEEP

      6144:UvSdpSrgpHnaZa4SmVbloxSaHva8rOpsjp86w1AgvP8hMfUKf8p:UvSS8Sa4vrZajlZwBPbQ

    Score
    10/10
    modiloaderdiscoverytrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks