Overview

overview

10

Static

static

3

558ae00d98...18.exe

windows7-x64

10

558ae00d98...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    558ae00d98b5f7cbcae34f997c1283df_JaffaCakes118

  • Size

    685KB

  • Sample

    241018-fdb6ya1cnp

  • MD5

    558ae00d98b5f7cbcae34f997c1283df

  • SHA1

    8abe2e15bd8d264c94989aae2a1850de4295c8cb

  • SHA256

    ce8233c92e46588c4b6917fc5cd42c7d0f513b1163efb65b986666a0bc0a6a40

  • SHA512

    be2a2e5ed3c39fb8e47bc65c7192f1f0d79535a11dc0e6c105ef23fee0d3d412743fc6e85e5ed0d4dc7924e60b20755eb66b6c750b4cab24a61eda6a7f2b10c4

  • SSDEEP

    12288:wHP7bYuvs528UfPr3jH2Vr3QX5/cturF3Z4mxxn6ku+RUlA2qCUSf:qPnRG288r3jHDPrQmXTe/aSf

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      558ae00d98b5f7cbcae34f997c1283df_JaffaCakes118

    • Size

      685KB

    • MD5

      558ae00d98b5f7cbcae34f997c1283df

    • SHA1

      8abe2e15bd8d264c94989aae2a1850de4295c8cb

    • SHA256

      ce8233c92e46588c4b6917fc5cd42c7d0f513b1163efb65b986666a0bc0a6a40

    • SHA512

      be2a2e5ed3c39fb8e47bc65c7192f1f0d79535a11dc0e6c105ef23fee0d3d412743fc6e85e5ed0d4dc7924e60b20755eb66b6c750b4cab24a61eda6a7f2b10c4

    • SSDEEP

      12288:wHP7bYuvs528UfPr3jH2Vr3QX5/cturF3Z4mxxn6ku+RUlA2qCUSf:qPnRG288r3jHDPrQmXTe/aSf

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks