Overview

overview

10

Static

static

3

f6c71fd060...18.exe

windows7-x64

10

f6c71fd060...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f6c71fd06073ae3100288c5cc2e2f4cd_JaffaCakes118

  • Size

    432KB

  • Sample

    240925-yygahavgnj

  • MD5

    f6c71fd06073ae3100288c5cc2e2f4cd

  • SHA1

    b7331750db0fd522eb6a45fd534d11586d8ac215

  • SHA256

    e65133758bd69e90f0cc7141670250acd90c4bd2feaf199e4820fd29502ab53b

  • SHA512

    8f6e159f0f130cf7d43150cbb0226b5195f5465c543af8be56482377b3e42c2fdce6072570243d9bec25adc8e348b85e86c9ea02f58b990b3d0272dbfb396380

  • SSDEEP

    12288:X/E/KTEEr5W/KEYdUhMHUielWBwAs1AWlBx7gIjlT:ze1mvel2xs1Ayx8IjlT

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      f6c71fd06073ae3100288c5cc2e2f4cd_JaffaCakes118

    • Size

      432KB

    • MD5

      f6c71fd06073ae3100288c5cc2e2f4cd

    • SHA1

      b7331750db0fd522eb6a45fd534d11586d8ac215

    • SHA256

      e65133758bd69e90f0cc7141670250acd90c4bd2feaf199e4820fd29502ab53b

    • SHA512

      8f6e159f0f130cf7d43150cbb0226b5195f5465c543af8be56482377b3e42c2fdce6072570243d9bec25adc8e348b85e86c9ea02f58b990b3d0272dbfb396380

    • SSDEEP

      12288:X/E/KTEEr5W/KEYdUhMHUielWBwAs1AWlBx7gIjlT:ze1mvel2xs1Ayx8IjlT

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks