Overview

overview

10

Static

static

10

f17157400e...18.exe

windows7-x64

10

f17157400e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f17157400e11b19195620f4199324c89_JaffaCakes118

  • Size

    297KB

  • Sample

    240922-g2wqxswaqh

  • MD5

    f17157400e11b19195620f4199324c89

  • SHA1

    60825eca1820c1bebdca713a73cbd6c59562164a

  • SHA256

    bc0bb85cc583c853d80899a23f3eae8b0edb3a2105174f1fc0faaedc226a6f55

  • SHA512

    b8937164873191864939e750f21522bad939bb6195675809550d0dd8db98c7995f4c49302b314f246e2d4b05100719ec8553b20167b50216f1d3b509b3ebfddc

  • SSDEEP

    6144:PG377xS2Vp2CeiorXdwTBgWx4W153RpcCJJvH1:ur7xS2Vp6RwTyCTbJJvH1

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      f17157400e11b19195620f4199324c89_JaffaCakes118

    • Size

      297KB

    • MD5

      f17157400e11b19195620f4199324c89

    • SHA1

      60825eca1820c1bebdca713a73cbd6c59562164a

    • SHA256

      bc0bb85cc583c853d80899a23f3eae8b0edb3a2105174f1fc0faaedc226a6f55

    • SHA512

      b8937164873191864939e750f21522bad939bb6195675809550d0dd8db98c7995f4c49302b314f246e2d4b05100719ec8553b20167b50216f1d3b509b3ebfddc

    • SSDEEP

      6144:PG377xS2Vp2CeiorXdwTBgWx4W153RpcCJJvH1:ur7xS2Vp6RwTyCTbJJvH1

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks