Overview

overview

10

Static

static

3

aa6825eb0b...18.exe

windows7-x64

10

aa6825eb0b...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aa6825eb0b6575246fd202d0837d8a6c_JaffaCakes118

  • Size

    1.8MB

  • Sample

    241128-bh19eavlen

  • MD5

    aa6825eb0b6575246fd202d0837d8a6c

  • SHA1

    8228aa066dce060e0fb1e762cf612ea3e820b2dd

  • SHA256

    cf13b77dfe1aa13688f5dced5890b8b7b911fb7a7b440532c64374609629fe73

  • SHA512

    2c1183d422b3b73a29c485f589d5c3d6dfbd9e001ea928d6afe4c403b4bc616830359a10306b99d29f774b6856580389444b3e06549f9e1fc030ea000e7c8eae

  • SSDEEP

    49152:plf5HTxC6AXMk9NJP5kPjoNOLl+VfrOeVPCtT:Dv2z5gjSOYKeVPCtT

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      aa6825eb0b6575246fd202d0837d8a6c_JaffaCakes118

    • Size

      1.8MB

    • MD5

      aa6825eb0b6575246fd202d0837d8a6c

    • SHA1

      8228aa066dce060e0fb1e762cf612ea3e820b2dd

    • SHA256

      cf13b77dfe1aa13688f5dced5890b8b7b911fb7a7b440532c64374609629fe73

    • SHA512

      2c1183d422b3b73a29c485f589d5c3d6dfbd9e001ea928d6afe4c403b4bc616830359a10306b99d29f774b6856580389444b3e06549f9e1fc030ea000e7c8eae

    • SSDEEP

      49152:plf5HTxC6AXMk9NJP5kPjoNOLl+VfrOeVPCtT:Dv2z5gjSOYKeVPCtT

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks