Overview

overview

10

Static

static

3

b557eee5a1...18.exe

windows7-x64

10

b557eee5a1...18.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b557eee5a111cbe1edf2d90c9981160c_JaffaCakes118

  • Size

    248KB

  • Sample

    241201-1txg2atmav

  • MD5

    b557eee5a111cbe1edf2d90c9981160c

  • SHA1

    366329b6e8784744fc558c9db34b63c33fc86089

  • SHA256

    f40772a9975494f57d5d8418c857289c7e9682d2a2b237b8af843cb9b084bafb

  • SHA512

    ffe6cc52991d47ed8ac2f0d1d877a37fd497c4d20cfe50d7690483fde0368c141cabebfd1d32fa9c960124910dbb23966a1264feb3f586932e1332a94b94bbe0

  • SSDEEP

    3072:m/RwtYgLDOJ9jUOqI5PF00ClUt37jEdjprc5Wf4L+8cGQi:yRwtYgK9jUOX5PFMlUtkd1rc5KYQ

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      b557eee5a111cbe1edf2d90c9981160c_JaffaCakes118

    • Size

      248KB

    • MD5

      b557eee5a111cbe1edf2d90c9981160c

    • SHA1

      366329b6e8784744fc558c9db34b63c33fc86089

    • SHA256

      f40772a9975494f57d5d8418c857289c7e9682d2a2b237b8af843cb9b084bafb

    • SHA512

      ffe6cc52991d47ed8ac2f0d1d877a37fd497c4d20cfe50d7690483fde0368c141cabebfd1d32fa9c960124910dbb23966a1264feb3f586932e1332a94b94bbe0

    • SSDEEP

      3072:m/RwtYgLDOJ9jUOqI5PF00ClUt37jEdjprc5Wf4L+8cGQi:yRwtYgK9jUOX5PFMlUtkd1rc5KYQ

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks