Overview

overview

10

Static

static

10

a136b82bf3...18.exe

windows7-x64

10

a136b82bf3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a136b82bf3db257750487c8be4a7dbf9_JaffaCakes118

  • Size

    417KB

  • Sample

    241126-lqarjaskfn

  • MD5

    a136b82bf3db257750487c8be4a7dbf9

  • SHA1

    0a4e7bac600253240dfed41b221cc01ce3c2b492

  • SHA256

    ea3710248a8aaab3c7b9e78a84fb56633ac3a02a44eb0fb38787b78ec968f9df

  • SHA512

    6d6892a7599530b054d0837ab586255de4e34c2f3f1c9e50e772e791265ba28675e347175902383fd38c2b8f222b42814f1f8870e0118c21829a6557c3f2ede0

  • SSDEEP

    6144:iunQUoeeZZU8zhrA/Cnx7W0f8UZ+qapZipW7+Z4Bv/4ae2RBot2:/QxPU8uCx7Wm8vGpWY4n4F2wt2

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      a136b82bf3db257750487c8be4a7dbf9_JaffaCakes118

    • Size

      417KB

    • MD5

      a136b82bf3db257750487c8be4a7dbf9

    • SHA1

      0a4e7bac600253240dfed41b221cc01ce3c2b492

    • SHA256

      ea3710248a8aaab3c7b9e78a84fb56633ac3a02a44eb0fb38787b78ec968f9df

    • SHA512

      6d6892a7599530b054d0837ab586255de4e34c2f3f1c9e50e772e791265ba28675e347175902383fd38c2b8f222b42814f1f8870e0118c21829a6557c3f2ede0

    • SSDEEP

      6144:iunQUoeeZZU8zhrA/Cnx7W0f8UZ+qapZipW7+Z4Bv/4ae2RBot2:/QxPU8uCx7Wm8vGpWY4n4F2wt2

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks