Overview

overview

10

Static

static

3

f2d58cb852...18.exe

windows7-x64

10

f2d58cb852...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f2d58cb8522cb313c7a92b26bea9caea_JaffaCakes118

  • Size

    644KB

  • Sample

    240923-wqdtaszbld

  • MD5

    f2d58cb8522cb313c7a92b26bea9caea

  • SHA1

    d1bc19e97d228f4db0166241b9abbaff4f91610a

  • SHA256

    3e522f7ec0cb1d3f860612bc9f8869e6435600c24d62124ff5cecd446c0713a5

  • SHA512

    1a0f57d9b2f082b3e85ed344a324cfd45917c3df598d12ba585150a229672882383b7d98ca00d81abe41a4ea8972b7df38a61ea24ab524eaa7798b70d2103883

  • SSDEEP

    12288:khOFQZ8SlF1faLVqpNyOYquXE9T/XnPOLO:eOF7QihqpNycuXSznPIO

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      f2d58cb8522cb313c7a92b26bea9caea_JaffaCakes118

    • Size

      644KB

    • MD5

      f2d58cb8522cb313c7a92b26bea9caea

    • SHA1

      d1bc19e97d228f4db0166241b9abbaff4f91610a

    • SHA256

      3e522f7ec0cb1d3f860612bc9f8869e6435600c24d62124ff5cecd446c0713a5

    • SHA512

      1a0f57d9b2f082b3e85ed344a324cfd45917c3df598d12ba585150a229672882383b7d98ca00d81abe41a4ea8972b7df38a61ea24ab524eaa7798b70d2103883

    • SSDEEP

      12288:khOFQZ8SlF1faLVqpNyOYquXE9T/XnPOLO:eOF7QihqpNycuXSznPIO

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks