Overview

overview

10

Static

static

3

e8bd5c903c...18.exe

windows7-x64

10

e8bd5c903c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e8bd5c903c1b2f2b979f85d11686a2c0_JaffaCakes118

  • Size

    324KB

  • Sample

    240918-kq6zassgjq

  • MD5

    e8bd5c903c1b2f2b979f85d11686a2c0

  • SHA1

    2e31b78090b6888be32983c43c6e3bd6507c7fbb

  • SHA256

    961147cab61b3a5161cd0587ca323c1d99eb0f0fc5a134eb95197969d2016e3c

  • SHA512

    618305d2ca44dbf7b0b8e20871bea7a95f266528805ebd842e693aa4827e2bae4c1da2ba749b37087deda865145f4a3f2e04c1d4e14ab614cc9db23100ded541

  • SSDEEP

    6144:x6hvfy7DJx+2Oa2OMAwEcydiIpdPLnQJgHTgXfzwvSe85F2m1e:x6hvAJxzh2LEdisdPDQjXcejs

Score
10/10
modiloaderdiscoveryevasiontrojan

Malware Config

Targets

    • Target

      e8bd5c903c1b2f2b979f85d11686a2c0_JaffaCakes118

    • Size

      324KB

    • MD5

      e8bd5c903c1b2f2b979f85d11686a2c0

    • SHA1

      2e31b78090b6888be32983c43c6e3bd6507c7fbb

    • SHA256

      961147cab61b3a5161cd0587ca323c1d99eb0f0fc5a134eb95197969d2016e3c

    • SHA512

      618305d2ca44dbf7b0b8e20871bea7a95f266528805ebd842e693aa4827e2bae4c1da2ba749b37087deda865145f4a3f2e04c1d4e14ab614cc9db23100ded541

    • SSDEEP

      6144:x6hvfy7DJx+2Oa2OMAwEcydiIpdPLnQJgHTgXfzwvSe85F2m1e:x6hvAJxzh2LEdisdPDQjXcejs

    Score
    10/10
    modiloaderdiscoveryevasiontrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks