Overview

overview

10

Static

static

10

ed952ec97e...18.exe

windows7-x64

10

ed952ec97e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed952ec97ed81af9fa63159b1224b6d1_JaffaCakes118

  • Size

    36KB

  • Sample

    240920-pl27rswdld

  • MD5

    ed952ec97ed81af9fa63159b1224b6d1

  • SHA1

    74e55433e42b076db381020ad42f085156eda7cd

  • SHA256

    426ed99091979f7fade6c2fa193da5ecdee34ce940a2df48be6c3e6efce9d7aa

  • SHA512

    19e2a85b92afc18c8524139b7bc818727f62ce13afd847ef10f983fd4f0888e6a0c51790743e17bb2cc7f9e260368b07fedb744256947c932f9dd30a098b0be1

  • SSDEEP

    768:zycqOQ0bwMK2M3fQde8Pfymg0M9EQfRo0ys/KzC:mcqOQbB3fQc8Pfymg0yxpByxzC

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      ed952ec97ed81af9fa63159b1224b6d1_JaffaCakes118

    • Size

      36KB

    • MD5

      ed952ec97ed81af9fa63159b1224b6d1

    • SHA1

      74e55433e42b076db381020ad42f085156eda7cd

    • SHA256

      426ed99091979f7fade6c2fa193da5ecdee34ce940a2df48be6c3e6efce9d7aa

    • SHA512

      19e2a85b92afc18c8524139b7bc818727f62ce13afd847ef10f983fd4f0888e6a0c51790743e17bb2cc7f9e260368b07fedb744256947c932f9dd30a098b0be1

    • SSDEEP

      768:zycqOQ0bwMK2M3fQde8Pfymg0M9EQfRo0ys/KzC:mcqOQbB3fQc8Pfymg0yxpByxzC

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks