Overview

overview

10

Static

static

5

9b93717267...18.exe

windows7-x64

10

9b93717267...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9b93717267a944ab6f736b461c5a148d_JaffaCakes118

  • Size

    111KB

  • Sample

    241125-p133lstnbl

  • MD5

    9b93717267a944ab6f736b461c5a148d

  • SHA1

    5630c281226fee9206584918821c726905049ad6

  • SHA256

    f5fe4a1d461c79c03ba09c3a5968410dab25cfaca2cd00c9b696991d9ed3fedc

  • SHA512

    7a4fb0424e7e8695ff9400d00feeaab302a93aa2b52abea3fc68a7795f434a53e5d5dadbf251226fc3b9055d0764916eb4df3e3944bf7f973c74fe40869daf1a

  • SSDEEP

    1536:cVuNAXTj4Fj/91/NnLZqeWEPVpa8DzePjkgcwYS7S5+Vfk09+2ES2IipqVWuGP/Z:Koy8j7VnNdrPHaSekwi+mW+2Zoout

Score
10/10
modiloaderdiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      9b93717267a944ab6f736b461c5a148d_JaffaCakes118

    • Size

      111KB

    • MD5

      9b93717267a944ab6f736b461c5a148d

    • SHA1

      5630c281226fee9206584918821c726905049ad6

    • SHA256

      f5fe4a1d461c79c03ba09c3a5968410dab25cfaca2cd00c9b696991d9ed3fedc

    • SHA512

      7a4fb0424e7e8695ff9400d00feeaab302a93aa2b52abea3fc68a7795f434a53e5d5dadbf251226fc3b9055d0764916eb4df3e3944bf7f973c74fe40869daf1a

    • SSDEEP

      1536:cVuNAXTj4Fj/91/NnLZqeWEPVpa8DzePjkgcwYS7S5+Vfk09+2ES2IipqVWuGP/Z:Koy8j7VnNdrPHaSekwi+mW+2Zoout

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks