Overview

overview

10

Static

static

3

ef47dc8ed4...18.exe

windows7-x64

10

ef47dc8ed4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ef47dc8ed4588f80c676fa26a0e437d6_JaffaCakes118

  • Size

    494KB

  • Sample

    240921-hsqnzszfpj

  • MD5

    ef47dc8ed4588f80c676fa26a0e437d6

  • SHA1

    945c118677be48838afb958de5e06e5953ec4a7e

  • SHA256

    47650245af5e31038b0c7ac5038b17a3bff8acb2b37929258ead84f55354b139

  • SHA512

    cf8045c7e7e2cfb311ac563a97da20aee854d39feb4ed3f68c0a51a38dfd24b7381b1a178739fdfe2be91bdc6398ffa9e8c4058c1a7369cd48196f51f96088ec

  • SSDEEP

    6144:Y6T60qmwaw40TzxiUjER7tYfHE1RSMbzfDj2Rgyz/KrzUvbljpnyA4ybq1D4+TGL:3T6XWIVc1tYfk1YU/9+bnyYbGfTg

Score
10/10
modiloaderdiscoveryevasiontrojan

Malware Config

Targets

    • Target

      ef47dc8ed4588f80c676fa26a0e437d6_JaffaCakes118

    • Size

      494KB

    • MD5

      ef47dc8ed4588f80c676fa26a0e437d6

    • SHA1

      945c118677be48838afb958de5e06e5953ec4a7e

    • SHA256

      47650245af5e31038b0c7ac5038b17a3bff8acb2b37929258ead84f55354b139

    • SHA512

      cf8045c7e7e2cfb311ac563a97da20aee854d39feb4ed3f68c0a51a38dfd24b7381b1a178739fdfe2be91bdc6398ffa9e8c4058c1a7369cd48196f51f96088ec

    • SSDEEP

      6144:Y6T60qmwaw40TzxiUjER7tYfHE1RSMbzfDj2Rgyz/KrzUvbljpnyA4ybq1D4+TGL:3T6XWIVc1tYfk1YU/9+bnyYbGfTg

    Score
    10/10
    modiloaderdiscoveryevasiontrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks