Overview

overview

10

Static

static

3

ebbeae80ae...18.exe

windows7-x64

10

ebbeae80ae...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ebbeae80ae54f109544264b22bbed2e4_JaffaCakes118

  • Size

    684KB

  • Sample

    240919-t3d9gsygqp

  • MD5

    ebbeae80ae54f109544264b22bbed2e4

  • SHA1

    5aec8d76cdb751d54c02e7ed0905f9bdeed850b0

  • SHA256

    9bda2334e6a67963fafbd7d1c6400ba813e2a6b7a847b8930f7519c86575aee1

  • SHA512

    ed423202070440f631ba59bc16ab374076717f0237e8c9b990f1924201ee5004b2bd0f3ed90f0aa192874e47a610142862503fa107ac6940ba4097769d32fd11

  • SSDEEP

    12288:I2KuWpy+4kIxmE9zZDXLDQh6tO+1f9OrlF3Z4mxxv0MHoTAFbHx:W7pr4kXwXLjtOAf9OrlQmXvK8x

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      ebbeae80ae54f109544264b22bbed2e4_JaffaCakes118

    • Size

      684KB

    • MD5

      ebbeae80ae54f109544264b22bbed2e4

    • SHA1

      5aec8d76cdb751d54c02e7ed0905f9bdeed850b0

    • SHA256

      9bda2334e6a67963fafbd7d1c6400ba813e2a6b7a847b8930f7519c86575aee1

    • SHA512

      ed423202070440f631ba59bc16ab374076717f0237e8c9b990f1924201ee5004b2bd0f3ed90f0aa192874e47a610142862503fa107ac6940ba4097769d32fd11

    • SSDEEP

      12288:I2KuWpy+4kIxmE9zZDXLDQh6tO+1f9OrlF3Z4mxxv0MHoTAFbHx:W7pr4kXwXLjtOAf9OrlQmXvK8x

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks