Overview

overview

10

Static

static

10

a620e2677d...18.exe

windows7-x64

10

a620e2677d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a620e2677db3c7a7a4e15219a3757b90_JaffaCakes118

  • Size

    148KB

  • Sample

    241127-f2j7fsyrg1

  • MD5

    a620e2677db3c7a7a4e15219a3757b90

  • SHA1

    01c3fe1c637d72fe0938671e01e937565a732c19

  • SHA256

    c17493b8d0d5616585cbb51682b3866ca196202e37a491043839928551675831

  • SHA512

    f7422178590ed2009df35bae8b4f7766aeb0d89b51befd0270066a59957cac910cb685c3ce9d34261e2748ce2f080b450d1a5fc0aa61b9783eb9bc77e99c00bd

  • SSDEEP

    3072:yVA+xbfCu90nTnXjj62f2rM4vks8nU3mhWlIj2Y/88:yBfCuWnTXjj62b4v18UqwgX88

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      a620e2677db3c7a7a4e15219a3757b90_JaffaCakes118

    • Size

      148KB

    • MD5

      a620e2677db3c7a7a4e15219a3757b90

    • SHA1

      01c3fe1c637d72fe0938671e01e937565a732c19

    • SHA256

      c17493b8d0d5616585cbb51682b3866ca196202e37a491043839928551675831

    • SHA512

      f7422178590ed2009df35bae8b4f7766aeb0d89b51befd0270066a59957cac910cb685c3ce9d34261e2748ce2f080b450d1a5fc0aa61b9783eb9bc77e99c00bd

    • SSDEEP

      3072:yVA+xbfCu90nTnXjj62f2rM4vks8nU3mhWlIj2Y/88:yBfCuWnTXjj62b4v18UqwgX88

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies WinLogon for persistence

      persistence

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks