Overview

overview

10

Static

static

10

eb8ae8e71f...18.exe

windows7-x64

10

eb8ae8e71f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eb8ae8e71f77aa67473c68c2049f4eba_JaffaCakes118

  • Size

    293KB

  • Sample

    240919-rzqr1athjl

  • MD5

    eb8ae8e71f77aa67473c68c2049f4eba

  • SHA1

    8887e860bf15ddd8a1cc5436b864cdbc5a34bcec

  • SHA256

    bbcd690cff71ebc79712b0391c44ba1a20fbdbb4ca73f4c5baab39b898e948cc

  • SHA512

    1dd4dbaa4e61c5a8ea0ce2341f1243d5623ef66c0aafc0101ca7471cf61af100ff49e96ea57677241e0319816e91cf7a0933bd2b671e17ec6d0b1c8180529263

  • SSDEEP

    6144:RG38xS2Vp2CeiorXdwTBgWx4ETJC531CpcCJJvHB:EsxS2Vp6RwTyCHbJJvHB

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      eb8ae8e71f77aa67473c68c2049f4eba_JaffaCakes118

    • Size

      293KB

    • MD5

      eb8ae8e71f77aa67473c68c2049f4eba

    • SHA1

      8887e860bf15ddd8a1cc5436b864cdbc5a34bcec

    • SHA256

      bbcd690cff71ebc79712b0391c44ba1a20fbdbb4ca73f4c5baab39b898e948cc

    • SHA512

      1dd4dbaa4e61c5a8ea0ce2341f1243d5623ef66c0aafc0101ca7471cf61af100ff49e96ea57677241e0319816e91cf7a0933bd2b671e17ec6d0b1c8180529263

    • SSDEEP

      6144:RG38xS2Vp2CeiorXdwTBgWx4ETJC531CpcCJJvHB:EsxS2Vp6RwTyCHbJJvHB

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks