Overview

overview

10

Static

static

3

06f5f62343...18.exe

windows7-x64

10

06f5f62343...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06f5f623431d3515825f16ee3393b9f0_JaffaCakes118

  • Size

    1.0MB

  • Sample

    241001-xfkpjaydkc

  • MD5

    06f5f623431d3515825f16ee3393b9f0

  • SHA1

    45b707f82e4729083d77cadc626c03144303c3cf

  • SHA256

    63e7b6d600995f6e3290f357b1741494ef805c9b1fdbec1754419ab3fd138326

  • SHA512

    2d73b5ccc05289f52e8eac10fd7b338fe4c5aab78928cf92af19f11f2b55b9b27c3e4e6db8b4d647d28287fcab1e373659ddbcbcaaa64fa12f6a82f35cb5f7cc

  • SSDEEP

    24576:FqQmXEzlkISmcuCym0u9s7SkKD1bRhbJysR:FLm03SFfRs7STpLTR

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      06f5f623431d3515825f16ee3393b9f0_JaffaCakes118

    • Size

      1.0MB

    • MD5

      06f5f623431d3515825f16ee3393b9f0

    • SHA1

      45b707f82e4729083d77cadc626c03144303c3cf

    • SHA256

      63e7b6d600995f6e3290f357b1741494ef805c9b1fdbec1754419ab3fd138326

    • SHA512

      2d73b5ccc05289f52e8eac10fd7b338fe4c5aab78928cf92af19f11f2b55b9b27c3e4e6db8b4d647d28287fcab1e373659ddbcbcaaa64fa12f6a82f35cb5f7cc

    • SSDEEP

      24576:FqQmXEzlkISmcuCym0u9s7SkKD1bRhbJysR:FLm03SFfRs7STpLTR

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks