Overview

overview

10

Static

static

7

f2bdf427e6...18.exe

windows7-x64

10

f2bdf427e6...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f2bdf427e6b366bbd7bc9717c76e75b8_JaffaCakes118

  • Size

    633KB

  • Sample

    240923-vqly8sxfmd

  • MD5

    f2bdf427e6b366bbd7bc9717c76e75b8

  • SHA1

    f9b59999941915f5fb48781ba3fa0f7c64447482

  • SHA256

    f5a8907d4ff8d947ad92c5642cea6325ca5614f5c4dae146feed16ae8bde09c6

  • SHA512

    98da8c6faf3ed3514e8c5b1fd6ad0e610119a0d28af63ccce756d6d6e2c9174becbbf7af2f11d4af581b89f76006b46318618bdce216b8331fe6cb27fc8fcd66

  • SSDEEP

    12288:5d0eDqjKgtBAW4Fqh4NBJAWqlaZzzgI1Zomv0O6LI+MtntdvUkREdc5j/TBNu2sK:5dxDqR6shkJF5xIL4tntZ5jPsXa

Score
10/10
modiloaderdiscoveryevasionthemidatrojan

Malware Config

Targets

    • Target

      f2bdf427e6b366bbd7bc9717c76e75b8_JaffaCakes118

    • Size

      633KB

    • MD5

      f2bdf427e6b366bbd7bc9717c76e75b8

    • SHA1

      f9b59999941915f5fb48781ba3fa0f7c64447482

    • SHA256

      f5a8907d4ff8d947ad92c5642cea6325ca5614f5c4dae146feed16ae8bde09c6

    • SHA512

      98da8c6faf3ed3514e8c5b1fd6ad0e610119a0d28af63ccce756d6d6e2c9174becbbf7af2f11d4af581b89f76006b46318618bdce216b8331fe6cb27fc8fcd66

    • SSDEEP

      12288:5d0eDqjKgtBAW4Fqh4NBJAWqlaZzzgI1Zomv0O6LI+MtntdvUkREdc5j/TBNu2sK:5dxDqR6shkJF5xIL4tntZ5jPsXa

    Score
    10/10
    modiloaderdiscoveryevasionthemidatrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks