Overview

overview

10

Static

static

7

edbe82bd13...18.exe

windows7-x64

10

edbe82bd13...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    edbe82bd13e5de60b9f043a01d126828_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240920-rbjnsazhjk

  • MD5

    edbe82bd13e5de60b9f043a01d126828

  • SHA1

    074e41b0b27462cfae6db83193d9f46f9026de0d

  • SHA256

    79d59d656a4226fafb6ffea20e8c71d3edc4ee8fe83eae9924c3ba688b4ca623

  • SHA512

    74d0f683ba8e19f315e87766603c426090b33368fbad6d88bd5bb82a1eb07c32df9f97f899488c935dfc234944d49aa57096289f5d36be1914318f89e30fc47a

  • SSDEEP

    24576:1UOZVwo8PakUOrUbRXXayexnZHsG351mQKBMRswJWXhgOMcLzPRcrOxnI:15Zyo8PakUO4tal3aQKBMRFSsqZ0k

Score
10/10
modiloaderdiscoveryevasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      edbe82bd13e5de60b9f043a01d126828_JaffaCakes118

    • Size

      1.3MB

    • MD5

      edbe82bd13e5de60b9f043a01d126828

    • SHA1

      074e41b0b27462cfae6db83193d9f46f9026de0d

    • SHA256

      79d59d656a4226fafb6ffea20e8c71d3edc4ee8fe83eae9924c3ba688b4ca623

    • SHA512

      74d0f683ba8e19f315e87766603c426090b33368fbad6d88bd5bb82a1eb07c32df9f97f899488c935dfc234944d49aa57096289f5d36be1914318f89e30fc47a

    • SSDEEP

      24576:1UOZVwo8PakUOrUbRXXayexnZHsG351mQKBMRswJWXhgOMcLzPRcrOxnI:15Zyo8PakUO4tal3aQKBMRFSsqZ0k

    Score
    10/10
    modiloaderdiscoveryevasionpersistencethemidatrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks