Overview

overview

10

Static

static

3

e91bfaf643...18.exe

windows7-x64

10

e91bfaf643...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e91bfaf6436c8e7cea12d5c4e7dd41cb_JaffaCakes118

  • Size

    241KB

  • Sample

    240918-plkbyszgqf

  • MD5

    e91bfaf6436c8e7cea12d5c4e7dd41cb

  • SHA1

    cc890aef4bfa783860401a4888c4c5a8f6b99889

  • SHA256

    d58c0807d9e47a1aa642cfcddc849d76608cbe8e9e8cb8604f47db93f54f1a59

  • SHA512

    f501f31c3d1d3215485fa204eebdb3885efd35cd62a8236ca76452328abd1d95ae232e876e0d0d4ff3680a14f9d5b394920ff6fb2034d17da5cd64f440bebaff

  • SSDEEP

    6144:WbTo8mhn+TupXuBPhhDZ2NllBzuTnDuwX5:zLnuPhhsNrBcDuwX5

Score
10/10
modiloaderdiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      e91bfaf6436c8e7cea12d5c4e7dd41cb_JaffaCakes118

    • Size

      241KB

    • MD5

      e91bfaf6436c8e7cea12d5c4e7dd41cb

    • SHA1

      cc890aef4bfa783860401a4888c4c5a8f6b99889

    • SHA256

      d58c0807d9e47a1aa642cfcddc849d76608cbe8e9e8cb8604f47db93f54f1a59

    • SHA512

      f501f31c3d1d3215485fa204eebdb3885efd35cd62a8236ca76452328abd1d95ae232e876e0d0d4ff3680a14f9d5b394920ff6fb2034d17da5cd64f440bebaff

    • SSDEEP

      6144:WbTo8mhn+TupXuBPhhDZ2NllBzuTnDuwX5:zLnuPhhsNrBcDuwX5

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks