General

  • Target

    eb4daf0d3bce52ce298593c34aaa2785_JaffaCakes118

  • Size

    248KB

  • Sample

    240919-pax4nsxdpg

  • MD5

    eb4daf0d3bce52ce298593c34aaa2785

  • SHA1

    62db60c812f1466c035c21dea38c3db9172cff09

  • SHA256

    6716fd51bdaf13cb90d4d892489277141e78fc565e64f129f552023286613793

  • SHA512

    8045fc6421dc1b0ad1f777e17f1dc2c1872670f239f4f5da3a1b7debdebbbd5f16053fd09dbf0cd7b9ae87d67349b8fe3a50a26005ace5401ca2944f0e235260

  • SSDEEP

    6144:kq8IaQI5kdNbcUfz0Xta0AZLwoIOpvfDnPk:kq8/9krIA0ta0Alw1Od7Pk

Malware Config

Targets

    • Target

      eb4daf0d3bce52ce298593c34aaa2785_JaffaCakes118

    • Size

      248KB

    • MD5

      eb4daf0d3bce52ce298593c34aaa2785

    • SHA1

      62db60c812f1466c035c21dea38c3db9172cff09

    • SHA256

      6716fd51bdaf13cb90d4d892489277141e78fc565e64f129f552023286613793

    • SHA512

      8045fc6421dc1b0ad1f777e17f1dc2c1872670f239f4f5da3a1b7debdebbbd5f16053fd09dbf0cd7b9ae87d67349b8fe3a50a26005ace5401ca2944f0e235260

    • SSDEEP

      6144:kq8IaQI5kdNbcUfz0Xta0AZLwoIOpvfDnPk:kq8/9krIA0ta0Alw1Od7Pk

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks