Overview

overview

10

Static

static

3

ff51ecffc9...18.exe

windows7-x64

10

ff51ecffc9...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ff51ecffc9f998fb6c8f4eb1832e1207_JaffaCakes118

  • Size

    641KB

  • Sample

    240929-zp4j4stgma

  • MD5

    ff51ecffc9f998fb6c8f4eb1832e1207

  • SHA1

    0897e00df3db3a90721f2abc2eff039cead75263

  • SHA256

    98dd55247254be517c10e47adecce26cbefb200e49e48a5f5cba19a3230bc746

  • SHA512

    77d650430eabee7a54cd22b98609e0335c3c9512e3c09b9d980fc81a48c29e545ec70791ce535f3639a066f9f772bbeb38405765c283c8c36768906b06b41181

  • SSDEEP

    12288:+GtuKgMUhjPbHPGZ3IvFJ32Pn/ZzvvF3Z4mxx2DqVTVOCGr:TtZUhjP7rFd+BDvQmXVVTzGr

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      ff51ecffc9f998fb6c8f4eb1832e1207_JaffaCakes118

    • Size

      641KB

    • MD5

      ff51ecffc9f998fb6c8f4eb1832e1207

    • SHA1

      0897e00df3db3a90721f2abc2eff039cead75263

    • SHA256

      98dd55247254be517c10e47adecce26cbefb200e49e48a5f5cba19a3230bc746

    • SHA512

      77d650430eabee7a54cd22b98609e0335c3c9512e3c09b9d980fc81a48c29e545ec70791ce535f3639a066f9f772bbeb38405765c283c8c36768906b06b41181

    • SSDEEP

      12288:+GtuKgMUhjPbHPGZ3IvFJ32Pn/ZzvvF3Z4mxx2DqVTVOCGr:TtZUhjP7rFd+BDvQmXVVTzGr

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks