Overview

overview

10

Static

static

3

f83d61add2...18.exe

windows7-x64

10

f83d61add2...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f83d61add2376208541c29e6473685bd_JaffaCakes118

  • Size

    480KB

  • Sample

    240926-m8246steqj

  • MD5

    f83d61add2376208541c29e6473685bd

  • SHA1

    57fcdb09df4bdd12ffc414fcf49e98dad0564b20

  • SHA256

    d1a030eabd6de276b2c09a2eeae0b6b0042ec68bfda84fce4897a05bb79a56de

  • SHA512

    5c8d030b9551be5acc646571d403510deb610e48d35df2e8bcb2cff851e08cddbc1252960278faf58d1f2a30f51f178c4c636b2d84c98d5f5993a4d7e5a8955c

  • SSDEEP

    6144:0jyBsedK8ucLlybT6YvEle4unLcL/+9XNGLUGfgZz+LphvFhfKx/8GcsMBvMCmJ2:0eWQ/ucIvbsKLAIXPn+Dvr+esTCm8oa

Score
10/10
modiloaderbootkitdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      f83d61add2376208541c29e6473685bd_JaffaCakes118

    • Size

      480KB

    • MD5

      f83d61add2376208541c29e6473685bd

    • SHA1

      57fcdb09df4bdd12ffc414fcf49e98dad0564b20

    • SHA256

      d1a030eabd6de276b2c09a2eeae0b6b0042ec68bfda84fce4897a05bb79a56de

    • SHA512

      5c8d030b9551be5acc646571d403510deb610e48d35df2e8bcb2cff851e08cddbc1252960278faf58d1f2a30f51f178c4c636b2d84c98d5f5993a4d7e5a8955c

    • SSDEEP

      6144:0jyBsedK8ucLlybT6YvEle4unLcL/+9XNGLUGfgZz+LphvFhfKx/8GcsMBvMCmJ2:0eWQ/ucIvbsKLAIXPn+Dvr+esTCm8oa

    Score
    10/10
    modiloaderbootkitdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks