Overview

overview

10

Static

static

10

f250a56d62...18.exe

windows7-x64

10

f250a56d62...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f250a56d62a76d9f243c670b72fd83f5_JaffaCakes118

  • Size

    232KB

  • Sample

    240922-s44p4axbjd

  • MD5

    f250a56d62a76d9f243c670b72fd83f5

  • SHA1

    16436fb987d22183561124506f7095d4d3ce69c2

  • SHA256

    cf92cfd602320ff3b436085f513bf3e5ed9cabda7f3a9532f60e88660a547f20

  • SHA512

    8c3d5c17a659043a9f21b06a1572e2ee317b8c11a488cba1617c8766c62661d3663eed61d9c592af1a74d280baad4cb862d8b8f3a773c3de43fdc30f2edb4d8d

  • SSDEEP

    6144:V7F5YVIM7MaJc6mWRHH+o1SiTTuiO++vyX:V707MIc67JHP1SsTue+

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      f250a56d62a76d9f243c670b72fd83f5_JaffaCakes118

    • Size

      232KB

    • MD5

      f250a56d62a76d9f243c670b72fd83f5

    • SHA1

      16436fb987d22183561124506f7095d4d3ce69c2

    • SHA256

      cf92cfd602320ff3b436085f513bf3e5ed9cabda7f3a9532f60e88660a547f20

    • SHA512

      8c3d5c17a659043a9f21b06a1572e2ee317b8c11a488cba1617c8766c62661d3663eed61d9c592af1a74d280baad4cb862d8b8f3a773c3de43fdc30f2edb4d8d

    • SSDEEP

      6144:V7F5YVIM7MaJc6mWRHH+o1SiTTuiO++vyX:V707MIc67JHP1SsTue+

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks