Overview

overview

10

Static

static

3

b301e4f86c...18.exe

windows7-x64

10

b301e4f86c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b301e4f86c6836c5ee29fa45bb990cd8_JaffaCakes118

  • Size

    123KB

  • Sample

    241129-wwn68azlhv

  • MD5

    b301e4f86c6836c5ee29fa45bb990cd8

  • SHA1

    de25db6f4e9c1fa9a1f025187e476c7836b8bc37

  • SHA256

    f6ca348cea5017214b3652e76b99b6d16042fdfd112b8c5871f09d6bed0b4a2f

  • SHA512

    a4a28f85f92591c42443a6529dc873e5070570b7762398e98a5b3e7566262a98ce29b7bd1dfd934f851811a38a7a500f0a9fe2d5b12238d1bbe70dbce28b6d0e

  • SSDEEP

    3072:OG+u+hcH3lurpV3uft1ozvY9ITDCfoFgxwr0gjDGIo0:OGJlurb3uwzvYOTef+OwQyL

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      b301e4f86c6836c5ee29fa45bb990cd8_JaffaCakes118

    • Size

      123KB

    • MD5

      b301e4f86c6836c5ee29fa45bb990cd8

    • SHA1

      de25db6f4e9c1fa9a1f025187e476c7836b8bc37

    • SHA256

      f6ca348cea5017214b3652e76b99b6d16042fdfd112b8c5871f09d6bed0b4a2f

    • SHA512

      a4a28f85f92591c42443a6529dc873e5070570b7762398e98a5b3e7566262a98ce29b7bd1dfd934f851811a38a7a500f0a9fe2d5b12238d1bbe70dbce28b6d0e

    • SSDEEP

      3072:OG+u+hcH3lurpV3uft1ozvY9ITDCfoFgxwr0gjDGIo0:OGJlurb3uwzvYOTef+OwQyL

    Score
    10/10
    modiloaderdiscoverypersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies WinLogon for persistence

      persistence

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks