Overview

overview

10

Static

static

3

c3c7fa1619...18.exe

windows7-x64

10

c3c7fa1619...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c3c7fa161970b2bb3d91c44500c0e706_JaffaCakes118

  • Size

    336KB

  • Sample

    241204-wtf3tstrex

  • MD5

    c3c7fa161970b2bb3d91c44500c0e706

  • SHA1

    674bd54a273618fd9f068bbbce8f7ea794c3735d

  • SHA256

    c10bb54564195c206caead5d150e2e93bafd48b00c3388d29ba39bdbdd750425

  • SHA512

    bcefd70804a9960621db9136bda8b502a458411e77bed2765753b8efa45ffed884c0f09e732b95367d40be1f3e43d29b2b0c85619fc7f3935d2b85692f102561

  • SSDEEP

    6144:99uWL0gh/mIHFDPi8zbB8Wmxi16FRQ1Sm//JKbGIi8/ylvEWOvLd49lHWhYBZ:99tL0gh/mMFDp6Wmxi8FRwJAbHjylvEg

Score
10/10
modiloaderdefense_evasiondiscoverypersistencetrojan

Malware Config

Targets

    • Target

      c3c7fa161970b2bb3d91c44500c0e706_JaffaCakes118

    • Size

      336KB

    • MD5

      c3c7fa161970b2bb3d91c44500c0e706

    • SHA1

      674bd54a273618fd9f068bbbce8f7ea794c3735d

    • SHA256

      c10bb54564195c206caead5d150e2e93bafd48b00c3388d29ba39bdbdd750425

    • SHA512

      bcefd70804a9960621db9136bda8b502a458411e77bed2765753b8efa45ffed884c0f09e732b95367d40be1f3e43d29b2b0c85619fc7f3935d2b85692f102561

    • SSDEEP

      6144:99uWL0gh/mIHFDPi8zbB8Wmxi16FRQ1Sm//JKbGIi8/ylvEWOvLd49lHWhYBZ:99tL0gh/mMFDp6Wmxi8FRwJAbHjylvEg

    Score
    10/10
    modiloaderdiscoverypersistencetrojandefense_evasion

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks