Overview

overview

10

Static

static

3

bdf5ffd786...18.exe

windows7-x64

10

bdf5ffd786...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bdf5ffd7863a41b0848491d575ceea0d_JaffaCakes118

  • Size

    591KB

  • Sample

    241203-sjj5yswkdp

  • MD5

    bdf5ffd7863a41b0848491d575ceea0d

  • SHA1

    b4b99e3287ea4b2238bef526fea617209ee78b11

  • SHA256

    e84d30da4f4b0d27e3d1629663bb96a14ea0aee5d528eaf8f4a95e6e573c9ac9

  • SHA512

    bf09946fe3980b98a532d563bf6332e0183b24cae194f7a3d5314415f52c54327e050b9ae6dd058dce0fdd43731a8b7ae49d15b504d1c6c596ed5a43f9ee1880

  • SSDEEP

    12288:nO+0xagOqez6AtMjdnW09X8K6TNqrzHIE1c2obY7HLonGjgnrRbs:nO/cgOz6NdnWesKAqXomocfonG4rRbs

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      bdf5ffd7863a41b0848491d575ceea0d_JaffaCakes118

    • Size

      591KB

    • MD5

      bdf5ffd7863a41b0848491d575ceea0d

    • SHA1

      b4b99e3287ea4b2238bef526fea617209ee78b11

    • SHA256

      e84d30da4f4b0d27e3d1629663bb96a14ea0aee5d528eaf8f4a95e6e573c9ac9

    • SHA512

      bf09946fe3980b98a532d563bf6332e0183b24cae194f7a3d5314415f52c54327e050b9ae6dd058dce0fdd43731a8b7ae49d15b504d1c6c596ed5a43f9ee1880

    • SSDEEP

      12288:nO+0xagOqez6AtMjdnW09X8K6TNqrzHIE1c2obY7HLonGjgnrRbs:nO/cgOz6NdnWesKAqXomocfonG4rRbs

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks