Overview

overview

10

Static

static

7

f012f3173e...18.exe

windows7-x64

10

f012f3173e...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f012f3173e2ee7c2d12ec0dc15f5a360_JaffaCakes118

  • Size

    686KB

  • Sample

    240921-snpagazanq

  • MD5

    f012f3173e2ee7c2d12ec0dc15f5a360

  • SHA1

    46c43ec5b2d067eef8cef07843824f2a8679f140

  • SHA256

    789c5b51a4c5b4ff4c12f30d62ecc962914747d00a38a26f5a499d002ad023d7

  • SHA512

    cdccb791713d573a3e154df33edcb05790dfc9923b83a29e2964993453a788b271ccdf3afdda45dd84d12c368481f1a68184d7ab2e2aa0d7853b92c89527517d

  • SSDEEP

    12288:D7/CzPyBwCECARz+edDIg32qyIOyo+1tAGiKSGiGAOLpeXolcYW+lo:n6r2TszDf2qy5yo+1tZMEAOLDlcu

Score
10/10
modiloaderdiscoveryevasionthemidatrojan

Malware Config

Targets

    • Target

      f012f3173e2ee7c2d12ec0dc15f5a360_JaffaCakes118

    • Size

      686KB

    • MD5

      f012f3173e2ee7c2d12ec0dc15f5a360

    • SHA1

      46c43ec5b2d067eef8cef07843824f2a8679f140

    • SHA256

      789c5b51a4c5b4ff4c12f30d62ecc962914747d00a38a26f5a499d002ad023d7

    • SHA512

      cdccb791713d573a3e154df33edcb05790dfc9923b83a29e2964993453a788b271ccdf3afdda45dd84d12c368481f1a68184d7ab2e2aa0d7853b92c89527517d

    • SSDEEP

      12288:D7/CzPyBwCECARz+edDIg32qyIOyo+1tAGiKSGiGAOLpeXolcYW+lo:n6r2TszDf2qy5yo+1tZMEAOLDlcu

    Score
    10/10
    modiloaderdiscoveryevasionthemidatrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks