Overview

overview

10

Static

static

10

f850e5d761...18.exe

windows7-x64

10

f850e5d761...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f850e5d761b8795bef61f613bd5bc140_JaffaCakes118

  • Size

    249KB

  • Sample

    240926-n2m74swaqp

  • MD5

    f850e5d761b8795bef61f613bd5bc140

  • SHA1

    5d9f13d67e1c8d63df094c9c83eb112391836fd6

  • SHA256

    1f68aea04318ab02258f57a8d24fd0884391cbcc178df9a46942679fc53ac188

  • SHA512

    4ace3d2c33c01d80b11ced57557fa1841ecbd5eb4825eb21381ec3592ef03b3aa396c948db06f063f7c172e2206bb92e70a5b1d7dd6c93a8e682d8d0b0e74cca

  • SSDEEP

    3072:QPindVxC5N7jB+Iax1M+1SU7VdyFx3wwbRipdX3Iu2i+imVBfcGfS1OWCDHPT3c8:QPidTmN8IaGUZOx5SdIu0VCGWHCE

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      f850e5d761b8795bef61f613bd5bc140_JaffaCakes118

    • Size

      249KB

    • MD5

      f850e5d761b8795bef61f613bd5bc140

    • SHA1

      5d9f13d67e1c8d63df094c9c83eb112391836fd6

    • SHA256

      1f68aea04318ab02258f57a8d24fd0884391cbcc178df9a46942679fc53ac188

    • SHA512

      4ace3d2c33c01d80b11ced57557fa1841ecbd5eb4825eb21381ec3592ef03b3aa396c948db06f063f7c172e2206bb92e70a5b1d7dd6c93a8e682d8d0b0e74cca

    • SSDEEP

      3072:QPindVxC5N7jB+Iax1M+1SU7VdyFx3wwbRipdX3Iu2i+imVBfcGfS1OWCDHPT3c8:QPidTmN8IaGUZOx5SdIu0VCGWHCE

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks