Overview

overview

10

Static

static

3

f46adf6cfe...18.exe

windows7-x64

10

f46adf6cfe...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f46adf6cfe76fda0d879d0e16d8aec95_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240924-ywna2asglq

  • MD5

    f46adf6cfe76fda0d879d0e16d8aec95

  • SHA1

    8318b3ff514a6c48b713c885b913cd5ac2599d64

  • SHA256

    2b6b8f9608123c8177ba3f730bce248deb95e190c978649c91da2d75db49b92f

  • SHA512

    0f23a7a4c0fe9a9a3b6b66e23621c25d46a3afc57354e6838c5d74f914b10eff98cda67f0e1781e2261e042fa081332821515228fc31074fa4c90b70a59544e3

  • SSDEEP

    24576:9ClXWrGoqEGgMwK5+0UigR1AzzRXfhAQxsTwBc:4dWNn++hRKzFXfhAZ

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      f46adf6cfe76fda0d879d0e16d8aec95_JaffaCakes118

    • Size

      1.1MB

    • MD5

      f46adf6cfe76fda0d879d0e16d8aec95

    • SHA1

      8318b3ff514a6c48b713c885b913cd5ac2599d64

    • SHA256

      2b6b8f9608123c8177ba3f730bce248deb95e190c978649c91da2d75db49b92f

    • SHA512

      0f23a7a4c0fe9a9a3b6b66e23621c25d46a3afc57354e6838c5d74f914b10eff98cda67f0e1781e2261e042fa081332821515228fc31074fa4c90b70a59544e3

    • SSDEEP

      24576:9ClXWrGoqEGgMwK5+0UigR1AzzRXfhAQxsTwBc:4dWNn++hRKzFXfhAZ

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Sets service image path in registry

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks