Overview

overview

10

Static

static

3

906ac20536...18.exe

windows7-x64

10

906ac20536...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    906ac205366ee08598f28907939ae310_JaffaCakes118

  • Size

    348KB

  • Sample

    241123-yzmtnstqcy

  • MD5

    906ac205366ee08598f28907939ae310

  • SHA1

    a9af3927dcf8f5d6d3ccebfd721689c771bed311

  • SHA256

    e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27

  • SHA512

    3a7dbb1984a0845b22e14383e4ac3573a503a136a65ea904c129c9f27632367fb64bc42190b81e2fa073cdfcf7696a36e90263b4fcba9d811b647d9cab1abbb1

  • SSDEEP

    6144:VFjL41SWW+Yta+ySQ+GyoCZUdzlEOVciyGCE+riGDAGxZKcJv6Msx/BGbF:VFjs1SWpY/ySBVoCmdzlEqciy+yiGhZD

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      906ac205366ee08598f28907939ae310_JaffaCakes118

    • Size

      348KB

    • MD5

      906ac205366ee08598f28907939ae310

    • SHA1

      a9af3927dcf8f5d6d3ccebfd721689c771bed311

    • SHA256

      e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27

    • SHA512

      3a7dbb1984a0845b22e14383e4ac3573a503a136a65ea904c129c9f27632367fb64bc42190b81e2fa073cdfcf7696a36e90263b4fcba9d811b647d9cab1abbb1

    • SSDEEP

      6144:VFjL41SWW+Yta+ySQ+GyoCZUdzlEOVciyGCE+riGDAGxZKcJv6Msx/BGbF:VFjs1SWpY/ySBVoCmdzlEqciy+yiGhZD

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies WinLogon for persistence

      persistence

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks