Overview

overview

10

Static

static

3

8ecb49e4b3...18.exe

windows7-x64

10

8ecb49e4b3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8ecb49e4b3c9f1e4469ed0237d505b52_JaffaCakes118

  • Size

    1.8MB

  • Sample

    241104-dfa1jssane

  • MD5

    8ecb49e4b3c9f1e4469ed0237d505b52

  • SHA1

    6482f37a3568bfd0584881e678411534785bdce7

  • SHA256

    fc05cc57a8de5b04ab4e329a8d42010461ef51a275fe5b0159de5210876d730d

  • SHA512

    a35dab6f3f992c796ef58a9fa1e3d17eb3cd1c72cc769cfc056b953426d3787fe95fac84e3a927f3260371be661330af636c1be59d2da74583b4f2a879bfe8cf

  • SSDEEP

    49152:X1dlZolYt6L163lEYZwIB6HL0zQIaZp+4faO:X1dl2lYt6Ls1EcAroQj+7O

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      8ecb49e4b3c9f1e4469ed0237d505b52_JaffaCakes118

    • Size

      1.8MB

    • MD5

      8ecb49e4b3c9f1e4469ed0237d505b52

    • SHA1

      6482f37a3568bfd0584881e678411534785bdce7

    • SHA256

      fc05cc57a8de5b04ab4e329a8d42010461ef51a275fe5b0159de5210876d730d

    • SHA512

      a35dab6f3f992c796ef58a9fa1e3d17eb3cd1c72cc769cfc056b953426d3787fe95fac84e3a927f3260371be661330af636c1be59d2da74583b4f2a879bfe8cf

    • SSDEEP

      49152:X1dlZolYt6L163lEYZwIB6HL0zQIaZp+4faO:X1dl2lYt6Ls1EcAroQj+7O

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks