Overview

overview

10

Static

static

3

ec5b1319f0...18.exe

windows7-x64

10

ec5b1319f0...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ec5b1319f05dd4a84e3b8da3e5f727bb_JaffaCakes118

  • Size

    586KB

  • Sample

    240919-2z5k9swcqq

  • MD5

    ec5b1319f05dd4a84e3b8da3e5f727bb

  • SHA1

    7e53077048303f99fca027af8a1f3d663306f7c3

  • SHA256

    52c893f6f6a47cd0f09c46e3635a5fa24668fcb254af8d56013de9eca0cc0b9e

  • SHA512

    53760a03bacef8f8572c2965d333063f71087d679a14a14d5f3afa61ac6aba2bb06218e4e4ae0598adb15a04c18f449af7a63813c858a6b585e17c7512cd2764

  • SSDEEP

    12288:x8vliBeF26PQBS2hzmJF3Z4mxx4/zll/EpM/Mu:UlicsphzyQmXsz1

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      ec5b1319f05dd4a84e3b8da3e5f727bb_JaffaCakes118

    • Size

      586KB

    • MD5

      ec5b1319f05dd4a84e3b8da3e5f727bb

    • SHA1

      7e53077048303f99fca027af8a1f3d663306f7c3

    • SHA256

      52c893f6f6a47cd0f09c46e3635a5fa24668fcb254af8d56013de9eca0cc0b9e

    • SHA512

      53760a03bacef8f8572c2965d333063f71087d679a14a14d5f3afa61ac6aba2bb06218e4e4ae0598adb15a04c18f449af7a63813c858a6b585e17c7512cd2764

    • SSDEEP

      12288:x8vliBeF26PQBS2hzmJF3Z4mxx4/zll/EpM/Mu:UlicsphzyQmXsz1

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks