Overview

overview

10

Static

static

10

a1ae9b7358...18.exe

windows7-x64

10

a1ae9b7358...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a1ae9b7358aeeb270a18d2d4b79eb35a_JaffaCakes118

  • Size

    16KB

  • Sample

    241126-npv27ayrav

  • MD5

    a1ae9b7358aeeb270a18d2d4b79eb35a

  • SHA1

    e54517a6a5520bc680eb8f3a5dfbd1816a0cba49

  • SHA256

    01c3b10dd5d0a60c4bb6f0f64cf78d10c20a2376755a751fb14a813a2b5639be

  • SHA512

    3635692cb50e1f9dd008852653896d13a8cf91b7009a74aceff6e179ba3310d0c17fea2069c94e0a03b5072aa76c47b6612e802a70506d3c271a850e1d6ee4e3

  • SSDEEP

    384:6/nknSIcfkdZnSGX9t6ArYOWXo3+1JCIcj3WAA4T44I23:wnGSIcfkdZnz9cArMWOzcjmAffI

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      a1ae9b7358aeeb270a18d2d4b79eb35a_JaffaCakes118

    • Size

      16KB

    • MD5

      a1ae9b7358aeeb270a18d2d4b79eb35a

    • SHA1

      e54517a6a5520bc680eb8f3a5dfbd1816a0cba49

    • SHA256

      01c3b10dd5d0a60c4bb6f0f64cf78d10c20a2376755a751fb14a813a2b5639be

    • SHA512

      3635692cb50e1f9dd008852653896d13a8cf91b7009a74aceff6e179ba3310d0c17fea2069c94e0a03b5072aa76c47b6612e802a70506d3c271a850e1d6ee4e3

    • SSDEEP

      384:6/nknSIcfkdZnSGX9t6ArYOWXo3+1JCIcj3WAA4T44I23:wnGSIcfkdZnz9cArMWOzcjmAffI

    Score
    10/10
    modiloaderdiscoverypersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks