General

  • Target

    eefd73336673638ca2712268d6f9a6a0_JaffaCakes118

  • Size

    651KB

  • Sample

    240921-d3ks9sshqd

  • MD5

    eefd73336673638ca2712268d6f9a6a0

  • SHA1

    360c8ae3025888c06d20cde1995df0c296186101

  • SHA256

    dc9a5c9f6035e75066242dc7197f397456c0715c46f4fa891185484f35ca1930

  • SHA512

    b3a4cd93d1c4ec88ddb28698d9cc15ea51234adbb1c0076a2a8d4f63c01da8075ef92da5e9eb23606905d3e6003ff78c3cd070cc1c41931fbb4ed9b930de0e08

  • SSDEEP

    12288:kpyZT1JrCxu/mDwLRI6BxcDqp9aqCcajVuD3Z7BPQGMWYur0s0D:kUx1JjOD3SxcDDcNDqWYurL0

Malware Config

Targets

    • Target

      eefd73336673638ca2712268d6f9a6a0_JaffaCakes118

    • Size

      651KB

    • MD5

      eefd73336673638ca2712268d6f9a6a0

    • SHA1

      360c8ae3025888c06d20cde1995df0c296186101

    • SHA256

      dc9a5c9f6035e75066242dc7197f397456c0715c46f4fa891185484f35ca1930

    • SHA512

      b3a4cd93d1c4ec88ddb28698d9cc15ea51234adbb1c0076a2a8d4f63c01da8075ef92da5e9eb23606905d3e6003ff78c3cd070cc1c41931fbb4ed9b930de0e08

    • SSDEEP

      12288:kpyZT1JrCxu/mDwLRI6BxcDqp9aqCcajVuD3Z7BPQGMWYur0s0D:kUx1JjOD3SxcDDcNDqWYurL0

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Modifies visiblity of hidden/system files in Explorer

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Enumerates processes with tasklist

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.