Overview

overview

10

Static

static

3

f99f665b7f...18.exe

windows7-x64

10

f99f665b7f...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f99f665b7f25bedceb38d582a1760d2c_JaffaCakes118

  • Size

    575KB

  • Sample

    240927-dzlw6ashll

  • MD5

    f99f665b7f25bedceb38d582a1760d2c

  • SHA1

    34ac9371259c9d19167540e14a8feccfb264c2d9

  • SHA256

    dbc9209f1d2d72fbf83ba1b7be067eb26c9ce8f3ae9a9ffc0e24ca92f3aa8242

  • SHA512

    38874cb616ab3ce144b3682b35ebbd7fb2a0d94ae1445ef12fd2da3b4dd275a509744c8a0c5db5e9a41a1ea8aa10b04b482c265942c68e710bbd4f71e8a11ed2

  • SSDEEP

    12288:4iWUrWeD82EPwxax+GhCF3Z4mxxTphWg6WWi8ZnjcR7:4sqeMGaxP0QmXhWp6

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      f99f665b7f25bedceb38d582a1760d2c_JaffaCakes118

    • Size

      575KB

    • MD5

      f99f665b7f25bedceb38d582a1760d2c

    • SHA1

      34ac9371259c9d19167540e14a8feccfb264c2d9

    • SHA256

      dbc9209f1d2d72fbf83ba1b7be067eb26c9ce8f3ae9a9ffc0e24ca92f3aa8242

    • SHA512

      38874cb616ab3ce144b3682b35ebbd7fb2a0d94ae1445ef12fd2da3b4dd275a509744c8a0c5db5e9a41a1ea8aa10b04b482c265942c68e710bbd4f71e8a11ed2

    • SSDEEP

      12288:4iWUrWeD82EPwxax+GhCF3Z4mxxTphWg6WWi8ZnjcR7:4sqeMGaxP0QmXhWp6

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks