Overview

overview

10

Static

static

3

957fff0d7d...18.exe

windows7-x64

10

957fff0d7d...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    957fff0d7d75ea9459f374e01d110bf1_JaffaCakes118

  • Size

    2.6MB

  • Sample

    241124-smsw9s1qfl

  • MD5

    957fff0d7d75ea9459f374e01d110bf1

  • SHA1

    8d1c2579edca99d7daa738cc3cf5260ca3be4004

  • SHA256

    ecb27dfd7593fd280db6577df7e3b087f9f9754a69048c18637b325db7c55f21

  • SHA512

    938f43bfe62060a1df9b25e4c09a5716757f9e7e6e06140984fd26994916b2be36cf9963ffe88ff4176fcaabc2c02074de9f4d68479d45aec1081786121d2cba

  • SSDEEP

    49152:gnQ9O9jtwA5R+AkbtMS4Ps/rdneWdhKS6pTz6+9l6gzqqkfShnu6PEmij3pm:kB7L5UrOS4UpHKS6V+k7zqGDsmijp

Score
10/10
modiloaderdiscoveryevasiontrojan

Malware Config

Targets

    • Target

      957fff0d7d75ea9459f374e01d110bf1_JaffaCakes118

    • Size

      2.6MB

    • MD5

      957fff0d7d75ea9459f374e01d110bf1

    • SHA1

      8d1c2579edca99d7daa738cc3cf5260ca3be4004

    • SHA256

      ecb27dfd7593fd280db6577df7e3b087f9f9754a69048c18637b325db7c55f21

    • SHA512

      938f43bfe62060a1df9b25e4c09a5716757f9e7e6e06140984fd26994916b2be36cf9963ffe88ff4176fcaabc2c02074de9f4d68479d45aec1081786121d2cba

    • SSDEEP

      49152:gnQ9O9jtwA5R+AkbtMS4Ps/rdneWdhKS6pTz6+9l6gzqqkfShnu6PEmij3pm:kB7L5UrOS4UpHKS6V+k7zqGDsmijp

    Score
    10/10
    modiloaderdiscoveryevasiontrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks