Overview

overview

10

Static

static

10

f6476d36c8...18.exe

windows7-x64

10

f6476d36c8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f6476d36c8e89605a36630d167beaa0a_JaffaCakes118

  • Size

    302KB

  • Sample

    240925-sjg1lasapn

  • MD5

    f6476d36c8e89605a36630d167beaa0a

  • SHA1

    1dcede63c4d294a12637a7cef596a2090654816e

  • SHA256

    c22d6154787daffc08f484d3164a4b2fde51c108a018c26233d2840bab846b60

  • SHA512

    c9bbc4b907e4cf4ca49e8d4212d248f001d365913d66ffcbe5880592c56a02dd7e5f9ee3b3720e07573a474ddd2a459fb6726fe4bff065aa03d4e1542be20e82

  • SSDEEP

    6144:VYf6I+2JR8XiO9PmUUb1AsJbL4nAwCKcn3yLq2SYZs:o6I+2f8ZP/USyInAwoniBD

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      f6476d36c8e89605a36630d167beaa0a_JaffaCakes118

    • Size

      302KB

    • MD5

      f6476d36c8e89605a36630d167beaa0a

    • SHA1

      1dcede63c4d294a12637a7cef596a2090654816e

    • SHA256

      c22d6154787daffc08f484d3164a4b2fde51c108a018c26233d2840bab846b60

    • SHA512

      c9bbc4b907e4cf4ca49e8d4212d248f001d365913d66ffcbe5880592c56a02dd7e5f9ee3b3720e07573a474ddd2a459fb6726fe4bff065aa03d4e1542be20e82

    • SSDEEP

      6144:VYf6I+2JR8XiO9PmUUb1AsJbL4nAwCKcn3yLq2SYZs:o6I+2f8ZP/USyInAwoniBD

    Score
    10/10
    modiloaderdiscoverypersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks