Overview

overview

10

Static

static

3

f358747b28...18.exe

windows7-x64

10

f358747b28...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f358747b283ae9e8c87e7ee649ea4785_JaffaCakes118

  • Size

    626KB

  • Sample

    240924-lkh6qazapj

  • MD5

    f358747b283ae9e8c87e7ee649ea4785

  • SHA1

    8529ab6a573a3da3cbcf9f3a9432914bd0ee5ed0

  • SHA256

    0540982449bf480cfea0d601bbca24ee2dcf30765fdd17c55ac168b4cb18d602

  • SHA512

    7f6780e6935ec2903f7f7b42039df0e316a9db8c7922c77a8867e8d243d380aa72502dc4c444b761347e2a774315ce80784390b07a303e4003e8e755aa28323a

  • SSDEEP

    12288:W/Hll+rwezDksZpniFsfbBbfCvdtF3Z4mxx4hvXO22pvFvxSKdvwMnyWt0i:GTreXk6KsDBbfCFtQmX4hv+rpxSKhth

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      f358747b283ae9e8c87e7ee649ea4785_JaffaCakes118

    • Size

      626KB

    • MD5

      f358747b283ae9e8c87e7ee649ea4785

    • SHA1

      8529ab6a573a3da3cbcf9f3a9432914bd0ee5ed0

    • SHA256

      0540982449bf480cfea0d601bbca24ee2dcf30765fdd17c55ac168b4cb18d602

    • SHA512

      7f6780e6935ec2903f7f7b42039df0e316a9db8c7922c77a8867e8d243d380aa72502dc4c444b761347e2a774315ce80784390b07a303e4003e8e755aa28323a

    • SSDEEP

      12288:W/Hll+rwezDksZpniFsfbBbfCvdtF3Z4mxx4hvXO22pvFvxSKdvwMnyWt0i:GTreXk6KsDBbfCFtQmX4hv+rpxSKhth

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks