Overview

overview

10

Static

static

3

b220724a2e...18.exe

windows7-x64

10

b220724a2e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b220724a2e9600b554ccd887c7a39880_JaffaCakes118

  • Size

    444KB

  • Sample

    241129-ssy1gaxkcq

  • MD5

    b220724a2e9600b554ccd887c7a39880

  • SHA1

    36b799acdaf3870f51aaa229b1c4033d554a72e1

  • SHA256

    ea36623677d38a1901dbc5405f1087e62b1ead90a65401387bbbfeb8be850e40

  • SHA512

    d3f154e024f69168ce0e1564a888d42f981029a9ef30c747d4321a7fa46e87be9f1d26e57e5d7625675ecd459556bfc0d2528a4fef0951d727c7a42187b0456d

  • SSDEEP

    12288:SV+mzFHYEt+UmeGhiHbT613/p0thOYxG26sh+VR:S83x4GYbTWSthG2B+VR

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      b220724a2e9600b554ccd887c7a39880_JaffaCakes118

    • Size

      444KB

    • MD5

      b220724a2e9600b554ccd887c7a39880

    • SHA1

      36b799acdaf3870f51aaa229b1c4033d554a72e1

    • SHA256

      ea36623677d38a1901dbc5405f1087e62b1ead90a65401387bbbfeb8be850e40

    • SHA512

      d3f154e024f69168ce0e1564a888d42f981029a9ef30c747d4321a7fa46e87be9f1d26e57e5d7625675ecd459556bfc0d2528a4fef0951d727c7a42187b0456d

    • SSDEEP

      12288:SV+mzFHYEt+UmeGhiHbT613/p0thOYxG26sh+VR:S83x4GYbTWSthG2B+VR

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks