Overview

overview

10

Static

static

3

f5b8e89ecf...18.exe

windows7-x64

10

f5b8e89ecf...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f5b8e89ecf1d48662cdf7d21e71b675d_JaffaCakes118

  • Size

    300KB

  • Sample

    240925-lmt11a1eqb

  • MD5

    f5b8e89ecf1d48662cdf7d21e71b675d

  • SHA1

    e07c86b7d1f158282ee44e971529f4eeea1d7e43

  • SHA256

    a564770961a6e967a6f4c22dbc1c79312ce6f0876c5a8630975a8f0a6ea1d47a

  • SHA512

    085191ce66f8ee13ecf53b99de62714a7a4c9e095dc247593e04191eceb3bef8977a3bb58074530710bfb0efbb964f357a6db95195e4e24d6b7e69b4ec442862

  • SSDEEP

    6144:F0a8saWj8UKXXgHGT8BLEINpxLLmWqIbcis09qaV4aL+stl2ytYt:iaCWjtKXoGTYhTLoI4ibfdLL32t

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      f5b8e89ecf1d48662cdf7d21e71b675d_JaffaCakes118

    • Size

      300KB

    • MD5

      f5b8e89ecf1d48662cdf7d21e71b675d

    • SHA1

      e07c86b7d1f158282ee44e971529f4eeea1d7e43

    • SHA256

      a564770961a6e967a6f4c22dbc1c79312ce6f0876c5a8630975a8f0a6ea1d47a

    • SHA512

      085191ce66f8ee13ecf53b99de62714a7a4c9e095dc247593e04191eceb3bef8977a3bb58074530710bfb0efbb964f357a6db95195e4e24d6b7e69b4ec442862

    • SSDEEP

      6144:F0a8saWj8UKXXgHGT8BLEINpxLLmWqIbcis09qaV4aL+stl2ytYt:iaCWjtKXoGTYhTLoI4ibfdLL32t

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks