Overview

overview

10

Static

static

3

f3acb1d96a...18.exe

windows7-x64

10

f3acb1d96a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f3acb1d96ac4aaf84a413f6b95d41555_JaffaCakes118

  • Size

    479KB

  • Sample

    240924-p1mevsvgpp

  • MD5

    f3acb1d96ac4aaf84a413f6b95d41555

  • SHA1

    7fb4bbb056db75d35e57babbdf526476fd5330e8

  • SHA256

    1c6d5f557810852732a0c81f980431e7be9e0683f373f4533d8629029ffab04c

  • SHA512

    8ebc7f9a17cb4677144f1b61cec290fb029fdbcca664b7a97d6163c191f2ffb4a330364812298feaa7a7340909635e3a735239797a48016309ab734e41db6738

  • SSDEEP

    3072:Eaaaaaaaaaa7aaaaaaaaaa/aaaaaaaaaa7aaaaaaaaaanaaaaraaaaPaaaaraaaG:G73njPNjSbNKz/6l7RskM2H4n4o

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      f3acb1d96ac4aaf84a413f6b95d41555_JaffaCakes118

    • Size

      479KB

    • MD5

      f3acb1d96ac4aaf84a413f6b95d41555

    • SHA1

      7fb4bbb056db75d35e57babbdf526476fd5330e8

    • SHA256

      1c6d5f557810852732a0c81f980431e7be9e0683f373f4533d8629029ffab04c

    • SHA512

      8ebc7f9a17cb4677144f1b61cec290fb029fdbcca664b7a97d6163c191f2ffb4a330364812298feaa7a7340909635e3a735239797a48016309ab734e41db6738

    • SSDEEP

      3072:Eaaaaaaaaaa7aaaaaaaaaa/aaaaaaaaaa7aaaaaaaaaanaaaaraaaaPaaaaraaaG:G73njPNjSbNKz/6l7RskM2H4n4o

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks