Overview

overview

10

Static

static

7

eca65de78c...18.exe

windows7-x64

10

eca65de78c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eca65de78c7df5ed755f81cb75625d76_JaffaCakes118

  • Size

    1.0MB

  • Sample

    240920-crrxrstema

  • MD5

    eca65de78c7df5ed755f81cb75625d76

  • SHA1

    8306b077cdaa542b6f0a839cf19ea454e21523eb

  • SHA256

    18eae3e1ec9820f8191d12ee23785f459633995dffee4247d48efa21b1d1f3e9

  • SHA512

    39112d528ad12684c84c56dbfff2911a9af41b98149659015431dbad42a8432e9f44fe549573419dea80332c4262e677a4daafdc60bdc406d9132df1ba219e78

  • SSDEEP

    24576:ozhtDPvBSs5dOThYnOOZOqxCA7479Wy7x6Fs4Ki6GpJAVZje7f5V1z:ozhpRXwTeQA7YdsTTpJee7BV1

Score
10/10
modiloaderaspackv2discoverytrojan

Malware Config

Targets

    • Target

      eca65de78c7df5ed755f81cb75625d76_JaffaCakes118

    • Size

      1.0MB

    • MD5

      eca65de78c7df5ed755f81cb75625d76

    • SHA1

      8306b077cdaa542b6f0a839cf19ea454e21523eb

    • SHA256

      18eae3e1ec9820f8191d12ee23785f459633995dffee4247d48efa21b1d1f3e9

    • SHA512

      39112d528ad12684c84c56dbfff2911a9af41b98149659015431dbad42a8432e9f44fe549573419dea80332c4262e677a4daafdc60bdc406d9132df1ba219e78

    • SSDEEP

      24576:ozhtDPvBSs5dOThYnOOZOqxCA7479Wy7x6Fs4Ki6GpJAVZje7f5V1z:ozhpRXwTeQA7YdsTTpJee7BV1

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks