Overview

overview

10

Static

static

10

a20cc0e05c...18.exe

windows7-x64

10

a20cc0e05c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a20cc0e05cd4eaf70d777ed9d32ee6a3_JaffaCakes118

  • Size

    85KB

  • Sample

    241126-p5tpqssjdt

  • MD5

    a20cc0e05cd4eaf70d777ed9d32ee6a3

  • SHA1

    7b96ebe72b24b612a7288f6457e5ba1d3802578a

  • SHA256

    e1328a213eba0e6950636b9e87d13c187c68a339e6485e733c98f8fd28f47abd

  • SHA512

    befd479edf0e21fb1d2b2ae21ab58af4c18b5b666acc317134e7bb85cc5ada5ba5cfb8d15e28d2aee2de92d31fe706695a4122f4a0270d19e7f10b117164c711

  • SSDEEP

    1536:o/u59ALh6uG8S8rgA/4q8nzZsx29WnTJuIDF4rw/no5ihKE+9TWLW656A:Z5kBbS8rgAb8zPg14enfKE+9KLW656A

Score
10/10
modiloaderadwarediscoveryevasionstealertrojan

Malware Config

Targets

    • Target

      a20cc0e05cd4eaf70d777ed9d32ee6a3_JaffaCakes118

    • Size

      85KB

    • MD5

      a20cc0e05cd4eaf70d777ed9d32ee6a3

    • SHA1

      7b96ebe72b24b612a7288f6457e5ba1d3802578a

    • SHA256

      e1328a213eba0e6950636b9e87d13c187c68a339e6485e733c98f8fd28f47abd

    • SHA512

      befd479edf0e21fb1d2b2ae21ab58af4c18b5b666acc317134e7bb85cc5ada5ba5cfb8d15e28d2aee2de92d31fe706695a4122f4a0270d19e7f10b117164c711

    • SSDEEP

      1536:o/u59ALh6uG8S8rgA/4q8nzZsx29WnTJuIDF4rw/no5ihKE+9TWLW656A:Z5kBbS8rgAb8zPg14enfKE+9KLW656A

    Score
    10/10
    modiloaderadwarediscoveryevasionstealertrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies firewall policy service

      evasion

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks