Overview

overview

10

Static

static

10

00c08bf1d9...18.exe

windows7-x64

10

00c08bf1d9...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    00c08bf1d9a92bae9e38cb16864e5a30_JaffaCakes118

  • Size

    733KB

  • Sample

    240930-l1v58atcqb

  • MD5

    00c08bf1d9a92bae9e38cb16864e5a30

  • SHA1

    ce7756f9c23eeb86297de4ab59318397289db8db

  • SHA256

    440b81055de0d438e7ae2e6b7a8d8105c0a99ee53d5069456a31188e4e5659e3

  • SHA512

    fe9eeb25beeaa7953474ca5610b2469db10bb886453306a247d9eb7c1bc3bc0271c9099145931459b5bab631a016e0cfd24c831fb15ef739609928e7e5ea5b91

  • SSDEEP

    12288:o9nTQAiVtuiwlF4w+dGnS0LzPgm8cryDYTS7+W+JipxdWwaH3UqCILs9:o9nNMmlyeS0LzgsryuS7+WH1xx

Score
10/10
modiloaderdefense_evasiondiscoverypersistencetrojan

Malware Config

Targets

    • Target

      00c08bf1d9a92bae9e38cb16864e5a30_JaffaCakes118

    • Size

      733KB

    • MD5

      00c08bf1d9a92bae9e38cb16864e5a30

    • SHA1

      ce7756f9c23eeb86297de4ab59318397289db8db

    • SHA256

      440b81055de0d438e7ae2e6b7a8d8105c0a99ee53d5069456a31188e4e5659e3

    • SHA512

      fe9eeb25beeaa7953474ca5610b2469db10bb886453306a247d9eb7c1bc3bc0271c9099145931459b5bab631a016e0cfd24c831fb15ef739609928e7e5ea5b91

    • SSDEEP

      12288:o9nTQAiVtuiwlF4w+dGnS0LzPgm8cryDYTS7+W+JipxdWwaH3UqCILs9:o9nNMmlyeS0LzgsryuS7+WH1xx

    Score
    10/10
    modiloaderdefense_evasiondiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

      defense_evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks