Overview

overview

10

Static

static

3

e8b9991365...18.exe

windows7-x64

10

e8b9991365...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e8b9991365eb1ccf3c7bf63b38c35c66_JaffaCakes118

  • Size

    296KB

  • Sample

    240918-kkvdbasdqk

  • MD5

    e8b9991365eb1ccf3c7bf63b38c35c66

  • SHA1

    35007d846aeff0f7665a8f598f194b7ff5b5ae1d

  • SHA256

    1cc1810deeb17985a34565ae1c4d9d2e407a7ee532943a743ca57eac6ef6fa77

  • SHA512

    50d1eea3220a3a815600f555a357bccf9079167ccff0fca1a2ff82629b7adcb5d5c2f20d5c9e17afe333215d668bb8e3b969f41ac70af56abc11b4f3dc37bc73

  • SSDEEP

    6144:1J/eKIIL4fdyTrluzfd5Y7aDbeuTNQ/EQyRwlrm9ZEOf5KB18F:L/VIILMduydSieupQcLXeOfw38F

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      e8b9991365eb1ccf3c7bf63b38c35c66_JaffaCakes118

    • Size

      296KB

    • MD5

      e8b9991365eb1ccf3c7bf63b38c35c66

    • SHA1

      35007d846aeff0f7665a8f598f194b7ff5b5ae1d

    • SHA256

      1cc1810deeb17985a34565ae1c4d9d2e407a7ee532943a743ca57eac6ef6fa77

    • SHA512

      50d1eea3220a3a815600f555a357bccf9079167ccff0fca1a2ff82629b7adcb5d5c2f20d5c9e17afe333215d668bb8e3b969f41ac70af56abc11b4f3dc37bc73

    • SSDEEP

      6144:1J/eKIIL4fdyTrluzfd5Y7aDbeuTNQ/EQyRwlrm9ZEOf5KB18F:L/VIILMduydSieupQcLXeOfw38F

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks