Overview

overview

10

Static

static

10

f03035df9a...18.exe

windows7-x64

10

f03035df9a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f03035df9a8679c413285e777baf7666_JaffaCakes118

  • Size

    632KB

  • Sample

    240921-tybmss1hnc

  • MD5

    f03035df9a8679c413285e777baf7666

  • SHA1

    3aecc382b02048acc042b4e70f1bdb9af243946a

  • SHA256

    b1abcf66bfbe70b53cd3d35662f757ed799fb5b79c99c8c2d25199401c083f90

  • SHA512

    6420a6218df6a2a4827843c497707b2ee826d4060f1a2e93b511ee24fcd02fd74e49d2d543a3b3640affdb56eac2706baef3a0ed37644b8c4ff2e1b2c6f733d5

  • SSDEEP

    6144:eG377xS2Vp2CeiorXdwTBgWx4jt6J7grHb0RKjQIYZGzuEKuHoi3fn:dr7xS2Vp6RwTyCgvrARKjQItSEK0zf

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      f03035df9a8679c413285e777baf7666_JaffaCakes118

    • Size

      632KB

    • MD5

      f03035df9a8679c413285e777baf7666

    • SHA1

      3aecc382b02048acc042b4e70f1bdb9af243946a

    • SHA256

      b1abcf66bfbe70b53cd3d35662f757ed799fb5b79c99c8c2d25199401c083f90

    • SHA512

      6420a6218df6a2a4827843c497707b2ee826d4060f1a2e93b511ee24fcd02fd74e49d2d543a3b3640affdb56eac2706baef3a0ed37644b8c4ff2e1b2c6f733d5

    • SSDEEP

      6144:eG377xS2Vp2CeiorXdwTBgWx4jt6J7grHb0RKjQIYZGzuEKuHoi3fn:dr7xS2Vp6RwTyCgvrARKjQItSEK0zf

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks