Overview

overview

10

Static

static

3

8280199d86...18.exe

windows7-x64

10

8280199d86...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8280199d861e408ca8577d4059bb5bf6_JaffaCakes118

  • Size

    2.1MB

  • Sample

    241031-kpnrbswpbm

  • MD5

    8280199d861e408ca8577d4059bb5bf6

  • SHA1

    c09e4187bd7515ccb69fb9be5a3a0b1e9b19613c

  • SHA256

    d8e4c4602154f9c88841a9e1a8617267b9831fea0bd7f5d821fedcf3f7a72452

  • SHA512

    bbc2717ece8756d7326920429187037d811cdea51e7df4e415653b4f4965718417874d21e5652bb9f914155c103df4d4c7e6de81cda3fb2e11f0d49739eb5b54

  • SSDEEP

    49152:Mn7M8qsZ+ZcJrcXk5jGaHLp3NFIGz5f7ZAkHXMFVdP:eA8j+ZcJkk5jG2NGGJ7NXadP

Score
10/10
modiloaderdiscoveryevasiontrojan

Malware Config

Targets

    • Target

      8280199d861e408ca8577d4059bb5bf6_JaffaCakes118

    • Size

      2.1MB

    • MD5

      8280199d861e408ca8577d4059bb5bf6

    • SHA1

      c09e4187bd7515ccb69fb9be5a3a0b1e9b19613c

    • SHA256

      d8e4c4602154f9c88841a9e1a8617267b9831fea0bd7f5d821fedcf3f7a72452

    • SHA512

      bbc2717ece8756d7326920429187037d811cdea51e7df4e415653b4f4965718417874d21e5652bb9f914155c103df4d4c7e6de81cda3fb2e11f0d49739eb5b54

    • SSDEEP

      49152:Mn7M8qsZ+ZcJrcXk5jGaHLp3NFIGz5f7ZAkHXMFVdP:eA8j+ZcJkk5jG2NGGJ7NXadP

    Score
    10/10
    modiloaderdiscoveryevasiontrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks