Overview

overview

10

Static

static

3

8c5e61cb6d...18.exe

windows7-x64

10

8c5e61cb6d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8c5e61cb6d1f6befaadf530350fc5cc3_JaffaCakes118

  • Size

    227KB

  • Sample

    241103-tsszwsxnes

  • MD5

    8c5e61cb6d1f6befaadf530350fc5cc3

  • SHA1

    1a80d0c6a677caac3a52efa339285d008d812325

  • SHA256

    0245fa56ce0e882eadcf7d8701d96cb802513ae34fd6f603cebe09107d5d8a0c

  • SHA512

    1dc6525011dfd7af34837d01235b8190d77bca55b8de505606ffb7f7e1fbb4d59c5ea33387ec7b8bc9fab4ffd85277b9e1474014134bb8d88d046bdea3ef5d1b

  • SSDEEP

    6144:GvwtZMF0wOWOxjwliuLnzStSt0keHtYx8JJb3mGH7:GIteZ9yj8fSM0hCaJJyG

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      8c5e61cb6d1f6befaadf530350fc5cc3_JaffaCakes118

    • Size

      227KB

    • MD5

      8c5e61cb6d1f6befaadf530350fc5cc3

    • SHA1

      1a80d0c6a677caac3a52efa339285d008d812325

    • SHA256

      0245fa56ce0e882eadcf7d8701d96cb802513ae34fd6f603cebe09107d5d8a0c

    • SHA512

      1dc6525011dfd7af34837d01235b8190d77bca55b8de505606ffb7f7e1fbb4d59c5ea33387ec7b8bc9fab4ffd85277b9e1474014134bb8d88d046bdea3ef5d1b

    • SSDEEP

      6144:GvwtZMF0wOWOxjwliuLnzStSt0keHtYx8JJb3mGH7:GIteZ9yj8fSM0hCaJJyG

    Score
    10/10
    modiloaderdiscoverypersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies WinLogon for persistence

      persistence

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks