Overview

overview

10

Static

static

3

833e252339...18.exe

windows7-x64

10

833e252339...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    833e25233992bb9556c609abdcadd11a_JaffaCakes118

  • Size

    723KB

  • Sample

    241031-rhj8wszfmk

  • MD5

    833e25233992bb9556c609abdcadd11a

  • SHA1

    3e80b309e2b3405906b4a1bf19d026ba3399e5ab

  • SHA256

    a5e4209934ad961d7ba16168366b73ff156cb47fde69647dbd3ae74b315428fa

  • SHA512

    5f2da24ff3122337af58ecacc6bb427778b8fa072569a4aebb553d0ab3a6dde31a1d92cd42c6de44dd786afc260a398662cd0684d92428477fa52f24909bbced

  • SSDEEP

    12288:MmiUu4i7Qgq0TRo48OY+ahueMKzlZF3Z4mxxMDqVTVOCu:qUuDlq0TeT2aHZQmXrVTzu

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      833e25233992bb9556c609abdcadd11a_JaffaCakes118

    • Size

      723KB

    • MD5

      833e25233992bb9556c609abdcadd11a

    • SHA1

      3e80b309e2b3405906b4a1bf19d026ba3399e5ab

    • SHA256

      a5e4209934ad961d7ba16168366b73ff156cb47fde69647dbd3ae74b315428fa

    • SHA512

      5f2da24ff3122337af58ecacc6bb427778b8fa072569a4aebb553d0ab3a6dde31a1d92cd42c6de44dd786afc260a398662cd0684d92428477fa52f24909bbced

    • SSDEEP

      12288:MmiUu4i7Qgq0TRo48OY+ahueMKzlZF3Z4mxxMDqVTVOCu:qUuDlq0TeT2aHZQmXrVTzu

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks