General

  • Target

    f00893f24c5fcc3ae7ea5dd27178e06b_JaffaCakes118

  • Size

    753KB

  • Sample

    240921-r88zyaxgle

  • MD5

    f00893f24c5fcc3ae7ea5dd27178e06b

  • SHA1

    12e1210534c5305d7687426b1bc52e25959d977e

  • SHA256

    08ffc6fa6bee66d320c9e94cdfea406cb0b81ae5dfcf033dc2f50f62becb8ffa

  • SHA512

    f98a76f0cba32cd85aaae2f1a0507ef2c84af2d086eb73e23e5e5c96ba2b65e6b825a5146ecd89bc3bcb0fe5ee668b5554abd0329b1b2c3b886766754d706ff3

  • SSDEEP

    12288:r1SeDx+zOiuXSiXblnaLaubDGEUCJwz0+nsMu6QyQNf7jRCVvyxuivqsaCM16rqx:xSGx+K/iiQ5D1m0+oRNf7FCVriJaON0l

Malware Config

Targets

    • Target

      f00893f24c5fcc3ae7ea5dd27178e06b_JaffaCakes118

    • Size

      753KB

    • MD5

      f00893f24c5fcc3ae7ea5dd27178e06b

    • SHA1

      12e1210534c5305d7687426b1bc52e25959d977e

    • SHA256

      08ffc6fa6bee66d320c9e94cdfea406cb0b81ae5dfcf033dc2f50f62becb8ffa

    • SHA512

      f98a76f0cba32cd85aaae2f1a0507ef2c84af2d086eb73e23e5e5c96ba2b65e6b825a5146ecd89bc3bcb0fe5ee668b5554abd0329b1b2c3b886766754d706ff3

    • SSDEEP

      12288:r1SeDx+zOiuXSiXblnaLaubDGEUCJwz0+nsMu6QyQNf7jRCVvyxuivqsaCM16rqx:xSGx+K/iiQ5D1m0+oRNf7FCVriJaON0l

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v15

Tasks