Overview

overview

10

Static

static

10

880512faeb...18.exe

windows7-x64

10

880512faeb...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    880512faebf49f3534b69d88f32a6ea4_JaffaCakes118

  • Size

    38KB

  • Sample

    241102-1ypmzszkhj

  • MD5

    880512faebf49f3534b69d88f32a6ea4

  • SHA1

    a5de20f0191404142e6e6889f0710ae3d3a2bbda

  • SHA256

    6467b304e11f68304e8172da4e99f5a597d0bfcdeecd30f4f611afa5ab7df4f7

  • SHA512

    abcbee633597132c5c4827ba75f6140fe367748115ad6095b7e5fbf0aea003057c0c89602c170785bac75fcf92fb53e89e5cf472062242e999b6de63330acd3f

  • SSDEEP

    768:kFJL2QscvNGaiDf12520xMJqDUUAq+ft3BNQLf:Kl2QNN4D0qgDU7N0T

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      880512faebf49f3534b69d88f32a6ea4_JaffaCakes118

    • Size

      38KB

    • MD5

      880512faebf49f3534b69d88f32a6ea4

    • SHA1

      a5de20f0191404142e6e6889f0710ae3d3a2bbda

    • SHA256

      6467b304e11f68304e8172da4e99f5a597d0bfcdeecd30f4f611afa5ab7df4f7

    • SHA512

      abcbee633597132c5c4827ba75f6140fe367748115ad6095b7e5fbf0aea003057c0c89602c170785bac75fcf92fb53e89e5cf472062242e999b6de63330acd3f

    • SSDEEP

      768:kFJL2QscvNGaiDf12520xMJqDUUAq+ft3BNQLf:Kl2QNN4D0qgDU7N0T

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies WinLogon for persistence

      persistence

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks