Overview

overview

10

Static

static

3

3fe9296208...18.exe

windows7-x64

10

3fe9296208...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3fe92962081da9d708ca7cff7b7b0397_JaffaCakes118

  • Size

    516KB

  • Sample

    241013-pw1rpaxalc

  • MD5

    3fe92962081da9d708ca7cff7b7b0397

  • SHA1

    996dc5e2dcc4fe91b0c8d78358ef5a9c8535aa1c

  • SHA256

    ef39ddd79c5b9f22df70d6c782396da33f14cf6d1b9cc4de1fa58b39a26d1ebe

  • SHA512

    03ea9e75e117d429911e9e4ad276f4e654c50bb18e3ffbe6f82a4bedc5df520651007db7d975edf2523a5a2514e79de06b67c4bbc4e743878ba818e5cb2e2ef5

  • SSDEEP

    12288:nL7p0EULtPHTT6olPioaZNjLZF/ut8sgU7EHme8PzJEjMm:nL7pjUxX6Ck/fZctEUgmeIzJEY

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      3fe92962081da9d708ca7cff7b7b0397_JaffaCakes118

    • Size

      516KB

    • MD5

      3fe92962081da9d708ca7cff7b7b0397

    • SHA1

      996dc5e2dcc4fe91b0c8d78358ef5a9c8535aa1c

    • SHA256

      ef39ddd79c5b9f22df70d6c782396da33f14cf6d1b9cc4de1fa58b39a26d1ebe

    • SHA512

      03ea9e75e117d429911e9e4ad276f4e654c50bb18e3ffbe6f82a4bedc5df520651007db7d975edf2523a5a2514e79de06b67c4bbc4e743878ba818e5cb2e2ef5

    • SSDEEP

      12288:nL7p0EULtPHTT6olPioaZNjLZF/ut8sgU7EHme8PzJEjMm:nL7pjUxX6Ck/fZctEUgmeIzJEY

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks