Overview

overview

10

Static

static

10

a7d03bacb5...18.exe

windows7-x64

10

a7d03bacb5...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a7d03bacb5e4add586615998c76a9846_JaffaCakes118

  • Size

    140KB

  • Sample

    241127-pfybmazkdn

  • MD5

    a7d03bacb5e4add586615998c76a9846

  • SHA1

    ecfee0ce76a29a88b0b76efc1d89685ad2485adb

  • SHA256

    1ec5f3602547475192ddbab52e0b307c263477a04389de082b61f2057fc82b49

  • SHA512

    3aecfe5dccbdaa7cf0848040e7ffa222ee25171ed15695d800c8aaf26925f983b497c96bfa5004805629949f11434bbae7e3c032cade5d8e54c92a44a21e84c5

  • SSDEEP

    3072:HuepxZYYYYYYYYYYYUNHCtFQUdSo3cWmyYYHLZyESW/4697G:9pPYYYYYYYYYYYUNSyESJdyqESQJ

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      a7d03bacb5e4add586615998c76a9846_JaffaCakes118

    • Size

      140KB

    • MD5

      a7d03bacb5e4add586615998c76a9846

    • SHA1

      ecfee0ce76a29a88b0b76efc1d89685ad2485adb

    • SHA256

      1ec5f3602547475192ddbab52e0b307c263477a04389de082b61f2057fc82b49

    • SHA512

      3aecfe5dccbdaa7cf0848040e7ffa222ee25171ed15695d800c8aaf26925f983b497c96bfa5004805629949f11434bbae7e3c032cade5d8e54c92a44a21e84c5

    • SSDEEP

      3072:HuepxZYYYYYYYYYYYUNHCtFQUdSo3cWmyYYHLZyESW/4697G:9pPYYYYYYYYYYYUNSyESJdyqESQJ

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks