Overview

overview

10

Static

static

10

b06adf0b7c...18.exe

windows7-x64

10

b06adf0b7c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b06adf0b7cc598876491df473642b799_JaffaCakes118

  • Size

    273KB

  • Sample

    241129-lr98saymgs

  • MD5

    b06adf0b7cc598876491df473642b799

  • SHA1

    2d5b22109e4c63d4d413d6910cde0e501b7408da

  • SHA256

    af6d59f54e679ae2adeeccac25fc1af47beb8c4e974acb3908c1ff7396a495eb

  • SHA512

    9af08101ceb9b8059849bdf67a07fba83571051eb33db42e1a5e13391e1cae38e2f249cbd7d1ad900dfbc9dc484172790caa679b22d4c78a52507194f4ec01b2

  • SSDEEP

    6144:tG377xS2Vp2CeiorXdwTBgWx4b53upcCJJvHS:Qr7xS2Vp6RwTyCfbJJvHS

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      b06adf0b7cc598876491df473642b799_JaffaCakes118

    • Size

      273KB

    • MD5

      b06adf0b7cc598876491df473642b799

    • SHA1

      2d5b22109e4c63d4d413d6910cde0e501b7408da

    • SHA256

      af6d59f54e679ae2adeeccac25fc1af47beb8c4e974acb3908c1ff7396a495eb

    • SHA512

      9af08101ceb9b8059849bdf67a07fba83571051eb33db42e1a5e13391e1cae38e2f249cbd7d1ad900dfbc9dc484172790caa679b22d4c78a52507194f4ec01b2

    • SSDEEP

      6144:tG377xS2Vp2CeiorXdwTBgWx4b53upcCJJvHS:Qr7xS2Vp6RwTyCfbJJvHS

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks