Overview

overview

10

Static

static

7

f1018ac1a7...18.exe

windows7-x64

10

f1018ac1a7...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f1018ac1a7b66601ddb1471ae30dedec_JaffaCakes118

  • Size

    1.4MB

  • Sample

    240922-bsyk9svhjr

  • MD5

    f1018ac1a7b66601ddb1471ae30dedec

  • SHA1

    e9429e7b1832fa0ba5ba62c10d51c78441d8b5b1

  • SHA256

    4301ee8abbd804200a68439ec40ca195a7c25167a64e63f0ecdc1b532ba7d0f4

  • SHA512

    cd957be8d4c246574746ed482bf3189be84be7868ee4b8dddf986b3cd74eb40b3848cbd4519392056f2ee8b3821e721915c13c7fb806fa86b5888146f86431ab

  • SSDEEP

    24576:xB9n3ffcZ5zEhKSAjY4/9Hxk4H9qRuJh/g5wo1X1nw8ZMmG0ns6ahYdM:x7nvkDDSw/lR7fJZ5ww8y7

Score
10/10
modiloaderdiscoveryevasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      f1018ac1a7b66601ddb1471ae30dedec_JaffaCakes118

    • Size

      1.4MB

    • MD5

      f1018ac1a7b66601ddb1471ae30dedec

    • SHA1

      e9429e7b1832fa0ba5ba62c10d51c78441d8b5b1

    • SHA256

      4301ee8abbd804200a68439ec40ca195a7c25167a64e63f0ecdc1b532ba7d0f4

    • SHA512

      cd957be8d4c246574746ed482bf3189be84be7868ee4b8dddf986b3cd74eb40b3848cbd4519392056f2ee8b3821e721915c13c7fb806fa86b5888146f86431ab

    • SSDEEP

      24576:xB9n3ffcZ5zEhKSAjY4/9Hxk4H9qRuJh/g5wo1X1nw8ZMmG0ns6ahYdM:x7nvkDDSw/lR7fJZ5ww8y7

    Score
    10/10
    modiloaderdiscoveryevasionpersistencethemidatrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks