Overview

overview

10

Static

static

10

fa641edc81...18.exe

windows7-x64

10

fa641edc81...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa641edc81ec21b0bda7d6e47bd23a10_JaffaCakes118

  • Size

    1.6MB

  • Sample

    240927-pfnr7asbqr

  • MD5

    fa641edc81ec21b0bda7d6e47bd23a10

  • SHA1

    1a78415d815d1b974389b4824c2c5b082209a84c

  • SHA256

    2f74e41c8484e679aa1cf3ec97b5aadfcca0ec8d4fa75d325ae735223a7734a5

  • SHA512

    6e52986e834ceb49e70c645552ed2c38438bf385d48793a57983bc892577fef0da3f940090086ae7d8636427f845e75a11f9093c4d16a9f45324c732feb97dae

  • SSDEEP

    24576:ix03nIlcXgYZhukuphb03nZupGxe9qee4fjuS2Vp6RwT6JvHF:ix0ycXgYWFX0cz9/e4f0p6ST6dl

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      fa641edc81ec21b0bda7d6e47bd23a10_JaffaCakes118

    • Size

      1.6MB

    • MD5

      fa641edc81ec21b0bda7d6e47bd23a10

    • SHA1

      1a78415d815d1b974389b4824c2c5b082209a84c

    • SHA256

      2f74e41c8484e679aa1cf3ec97b5aadfcca0ec8d4fa75d325ae735223a7734a5

    • SHA512

      6e52986e834ceb49e70c645552ed2c38438bf385d48793a57983bc892577fef0da3f940090086ae7d8636427f845e75a11f9093c4d16a9f45324c732feb97dae

    • SSDEEP

      24576:ix03nIlcXgYZhukuphb03nZupGxe9qee4fjuS2Vp6RwT6JvHF:ix0ycXgYWFX0cz9/e4f0p6ST6dl

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks