Overview

overview

10

Static

static

5

fadc984589...18.exe

windows7-x64

10

fadc984589...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fadc98458983d65fcd7ca75f6adde1f2_JaffaCakes118

  • Size

    282KB

  • Sample

    240927-zaxs1syamk

  • MD5

    fadc98458983d65fcd7ca75f6adde1f2

  • SHA1

    3ba539e297ba8f4257e9b69a0276a57b166bb57e

  • SHA256

    21b967066209eed38333b392ea57f012dcbb9a9d81f067057773bde72280512c

  • SHA512

    9aa2e859b5831a914e95beae8579886fd273f70f20dc58ed31bc80c9341c3b0eab3a9603bb93028f30e9eaf84d8eb07bad6c7f53bccb2dc625cd190e07e1afbd

  • SSDEEP

    6144:b6gsDdvs/Q3gH+vpJX/h0HcKRCUcbE7XQp8eyN+9TakJ:psh0/DUPvhGcBEMp8eg+dv

Score
10/10
modiloaderdefense_evasiondiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      fadc98458983d65fcd7ca75f6adde1f2_JaffaCakes118

    • Size

      282KB

    • MD5

      fadc98458983d65fcd7ca75f6adde1f2

    • SHA1

      3ba539e297ba8f4257e9b69a0276a57b166bb57e

    • SHA256

      21b967066209eed38333b392ea57f012dcbb9a9d81f067057773bde72280512c

    • SHA512

      9aa2e859b5831a914e95beae8579886fd273f70f20dc58ed31bc80c9341c3b0eab3a9603bb93028f30e9eaf84d8eb07bad6c7f53bccb2dc625cd190e07e1afbd

    • SSDEEP

      6144:b6gsDdvs/Q3gH+vpJX/h0HcKRCUcbE7XQp8eyN+9TakJ:psh0/DUPvhGcBEMp8eg+dv

    Score
    10/10
    modiloaderdefense_evasiondiscoverypersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Impair Defenses: Safe Mode Boot

      defense_evasion

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks