Overview

overview

10

Static

static

3

8c99eb9169...18.exe

windows7-x64

10

8c99eb9169...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8c99eb916948aefa07aafc8e64705a0f_JaffaCakes118

  • Size

    592KB

  • Sample

    241103-vslq9azamf

  • MD5

    8c99eb916948aefa07aafc8e64705a0f

  • SHA1

    253ea4e5b14c06d24f395e06df4659e72b1c162c

  • SHA256

    6da6f68611750b563a7af4f786b07f871ad8970326d344aca4b85f16315d3379

  • SHA512

    d645c3917013a2220692ce8812ec38c3a9b2238dc60bb4cb0da5e005810d24baa681f39e32282a2fda8bfd4ecbd9c69d41567d2ca5dc00b8ec53c71065331862

  • SSDEEP

    6144:tUeqreW6n5nVB7xL5+MMaBcE/0T4LRPU9FFUa/a9z2y2X75x5rVxekrfZgj83uiD:tZVgMTcs0TlFGavdX75r5rSapqe

Score
10/10
modiloaderdiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      8c99eb916948aefa07aafc8e64705a0f_JaffaCakes118

    • Size

      592KB

    • MD5

      8c99eb916948aefa07aafc8e64705a0f

    • SHA1

      253ea4e5b14c06d24f395e06df4659e72b1c162c

    • SHA256

      6da6f68611750b563a7af4f786b07f871ad8970326d344aca4b85f16315d3379

    • SHA512

      d645c3917013a2220692ce8812ec38c3a9b2238dc60bb4cb0da5e005810d24baa681f39e32282a2fda8bfd4ecbd9c69d41567d2ca5dc00b8ec53c71065331862

    • SSDEEP

      6144:tUeqreW6n5nVB7xL5+MMaBcE/0T4LRPU9FFUa/a9z2y2X75x5rVxekrfZgj83uiD:tZVgMTcs0TlFGavdX75r5rSapqe

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks