Overview

overview

10

Static

static

3

ed35441818...18.exe

windows7-x64

10

ed35441818...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed35441818995030ea3e5ccdada17b8b_JaffaCakes118

  • Size

    288KB

  • Sample

    240920-kefb7sxgkn

  • MD5

    ed35441818995030ea3e5ccdada17b8b

  • SHA1

    3e1e9f15c5cfdd7ddc9d09a76e50b166c79751cb

  • SHA256

    53269367f4cd3a421484193957d5290b198593c3fc3823169a7b1634657e7f17

  • SHA512

    ce008badd19043e3775b292e2f1ab771ce6c8c7a06cb9f1a5fcba7a2918e1953aef5d850933c67851195375f67ffcb0680684d66a70713950c784c3a8c625ad2

  • SSDEEP

    6144:4JO29OhQHmf5LPyBmIB3XdjMMYw7KxyDP/0aTlRgZ5r:4zuQGRLKTVFD3tTYZ5r

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      ed35441818995030ea3e5ccdada17b8b_JaffaCakes118

    • Size

      288KB

    • MD5

      ed35441818995030ea3e5ccdada17b8b

    • SHA1

      3e1e9f15c5cfdd7ddc9d09a76e50b166c79751cb

    • SHA256

      53269367f4cd3a421484193957d5290b198593c3fc3823169a7b1634657e7f17

    • SHA512

      ce008badd19043e3775b292e2f1ab771ce6c8c7a06cb9f1a5fcba7a2918e1953aef5d850933c67851195375f67ffcb0680684d66a70713950c784c3a8c625ad2

    • SSDEEP

      6144:4JO29OhQHmf5LPyBmIB3XdjMMYw7KxyDP/0aTlRgZ5r:4zuQGRLKTVFD3tTYZ5r

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks