Overview

overview

10

Static

static

7

c60b982e5f...18.exe

windows7-x64

7

c60b982e5f...18.exe

windows10-2004-x64

7

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...te.dll

windows7-x64

3

$PLUGINSDI...te.dll

windows10-2004-x64

3

$PLUGINSDI...om.dll

windows7-x64

5

$PLUGINSDI...om.dll

windows10-2004-x64

5

$PLUGINSDIR/xml.dll

windows7-x64

3

$PLUGINSDIR/xml.dll

windows10-2004-x64

3

flash.dll

windows7-x64

3

flash.dll

windows10-2004-x64

3

help.chm

windows7-x64

1

help.chm

windows10-2004-x64

1

order.htm

windows7-x64

3

order.htm

windows10-2004-x64

3

top flash ...eo.exe

windows7-x64

10

top flash ...eo.exe

windows10-2004-x64

10

uninst.exe

windows7-x64

8

uninst.exe

windows10-2004-x64

8

�...��.url

windows7-x64

1

�...��.url

windows10-2004-x64

1

�...��.url

windows7-x64

1

�...��.url

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c60b982e5f0cf6cf628404adb69569c6_JaffaCakes118

  • Size

    2.5MB

  • Sample

    241205-frse3szngx

  • MD5

    c60b982e5f0cf6cf628404adb69569c6

  • SHA1

    d58f5bd576c6945a1334317ba5a3726f47b5a1a2

  • SHA256

    9f8ac42c6b88e50d04f8c0f2c45afd9387997345f4617280d057df7f03363bca

  • SHA512

    af792633bbd9d1e5071b1f8c1bbbfe0c2da5ca98a539f21ee9a919156c5696fe325a55dbf9a13bdb3c5b7ab9225f9b944c88f37ed061fdd7b008fcf0438f78b1

  • SSDEEP

    49152:V/CuyOAhK3mOWD7lrBhjAqR38MmhPfSimrUB4M0nvPaCElNBV+:8uyJhJbpPv8MUCxM4CCABV+

Score
10/10
modiloaderdiscoverytrojanupx

Malware Config

Targets

    • Target

      c60b982e5f0cf6cf628404adb69569c6_JaffaCakes118

    • Size

      2.5MB

    • MD5

      c60b982e5f0cf6cf628404adb69569c6

    • SHA1

      d58f5bd576c6945a1334317ba5a3726f47b5a1a2

    • SHA256

      9f8ac42c6b88e50d04f8c0f2c45afd9387997345f4617280d057df7f03363bca

    • SHA512

      af792633bbd9d1e5071b1f8c1bbbfe0c2da5ca98a539f21ee9a919156c5696fe325a55dbf9a13bdb3c5b7ab9225f9b944c88f37ed061fdd7b008fcf0438f78b1

    • SSDEEP

      49152:V/CuyOAhK3mOWD7lrBhjAqR38MmhPfSimrUB4M0nvPaCElNBV+:8uyJhJbpPv8MUCxM4CCABV+

    Score
    7/10
    discovery

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/DcryptDll.dll

    • Size

      14KB

    • MD5

      904beebec2790ee2ca0c90fc448ac7e0

    • SHA1

      40fabf1eb0a3b7168351c4514c5288216cb1566d

    • SHA256

      f730d9385bf72eac5d579bcf1f7e4330f1d239ca1054d4ead48e9e363d9f4222

    • SHA512

      8bdbbaaf73e396cf9fd9866b3e824b7e70c59a2bdefdb3236387e60d0e645d011265fe79fb193f6c0d6abe2e9c01260720c71cd8f068fcc4624760511c54efaa

    • SSDEEP

      192:apY9VuCnNCbs8dNyHdrvr5T1KEtx/9ehuhiDTUkSv/DxRyeHk51I7n13Xm:aptMNUjyVvGWxauhiDDS3DnyK7nF

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      0dc0cc7a6d9db685bf05a7e5f3ea4781

    • SHA1

      5d8b6268eeec9d8d904bc9d988a4b588b392213f

    • SHA256

      8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

    • SHA512

      814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

    • SSDEEP

      192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/NSISdl.dll

    • Size

      14KB

    • MD5

      254f13dfd61c5b7d2119eb2550491e1d

    • SHA1

      5083f6804ee3475f3698ab9e68611b0128e22fd6

    • SHA256

      fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

    • SHA512

      fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

    • SSDEEP

      192:t5ZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRYgsfA:fBo/680dCI5adOjFOg9//p27uNw2bo

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      00a0194c20ee912257df53bfe258ee4a

    • SHA1

      d7b4e319bc5119024690dc8230b9cc919b1b86b2

    • SHA256

      dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    • SHA512

      3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/locate.dll

    • Size

      17KB

    • MD5

      7d3317f57c1a368480ace3c0ca804eeb

    • SHA1

      d4c7e185bc64aac82339f51ba6c21cf0713c9f1a

    • SHA256

      d88a04c1e39db583eaad727fd390fe599ab10198ee040bfbdd22daefadbd2372

    • SHA512

      5598c2e6caa2f66edd48f8c8305e054d4b0740b5f2b7ed92cf197a13ac66ba99a32013d34b3c2e28d007ab7979eb90a50681324eb736b1410e7df1902e4ec32a

    • SSDEEP

      384:ev/vPBkA6dK8wiLe45naPji7hpx2kRV+qgm:evyvwiNnGji7Xxjc8

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/nsRandom.dll

    • Size

      21KB

    • MD5

      ab467b8dfaa660a0f0e5b26e28af5735

    • SHA1

      596abd2c31eaff3479edf2069db1c155b59ce74d

    • SHA256

      db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73

    • SHA512

      7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301

    • SSDEEP

      384:LCHDPMs4GdtyO5roguusMxUXiO3wOw95euooP2UgKbd9BvNtf:LCHD6Gh87MKXil/5r2U3z

    Score
    5/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/xml.dll

    • Size

      118KB

    • MD5

      42df1fbaa87567adf2b4050805a1a545

    • SHA1

      b892a6efbb39b7144248e0c0d79e53da474a9373

    • SHA256

      e900fcb9d598643eb0ee3e4005da925e73e70dbaa010edc4473e99ea0638b845

    • SHA512

      4537d408e2f54d07b018907c787da6c7340f909a1789416de33d090055eda8918f338d8571bc3b438dd89e5e03e0ded70c86702666f12adb98523a91cbb1de1d

    • SSDEEP

      1536:U2A8OSGjylgkara+70LICin9zgtg2LxowhtJu6MqSNicNEtIfF42q2KC:OzjLkarn7O+n9z2L6whFtGF42bK

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      flash.ocx

    • Size

      917KB

    • MD5

      fc3e17e12c2e31fac34b416b3dab829f

    • SHA1

      ca33d1fa3d27c67c8bf2503a7474ac4f9223ed49

    • SHA256

      471643ea9df42cc168412f33720f5b8cb1b391555cc795a5313224565274e9c0

    • SHA512

      01a35672f70fcec69136475fab9ed643364af1683d49cb07cf6e5e47f003e2b8d0a553c52c42222c9ab7be4014f4e31a4701d30e28acd3c92a5407af4cc9a4fe

    • SSDEEP

      24576:VvGzbaRNTt7tM7n0Nxt4oqN2eD65QmPNwJLKkn3WfhZXp:xmsxtJQn0Tt4rK5QmPNw4knGJpp

    Score
    3/10
    discovery
    behavioral17behavioral18

    • Target

      help.chm

    • Size

      127KB

    • MD5

      a10e28787a81ba1b455fafb75b880d9a

    • SHA1

      de3d240a577d3783d11bcdebada761f914f0cd24

    • SHA256

      de402cdc262485012d6ebe471afe6c51c9e5a830dccb6b1a1a59c54e0d74f832

    • SHA512

      6c5493c585e6abad568534c144c411cb12f0f403b103d2dec5b44b2effbda263de579a41c34e70444def5245a4955c8ab4af8b9d3d30a540f0bfa1880208c26a

    • SSDEEP

      3072:3nDxjCXyfqYxVuYRMjrj1wLStM/2PzYTlxu5sB+9s3fE:31UY1RQj1wWtMOPzSx7P3fE

    Score
    1/10
    behavioral19behavioral20

    • Target

      order.htm

    • Size

      4KB

    • MD5

      3466ad8d4f79883987a3e7169ccd5108

    • SHA1

      c749098f410170d1849609db8ef562cfea0ce9d7

    • SHA256

      284baddf885da8b57a35f6f2a72033ba6a60ab7940909094ff5744679d0961aa

    • SHA512

      d16fa72153b4b43f5bee978ffb7aa0a495641b2c6ff966e049dd300323e87b646687954618ae9225077086884844328e01ae41857f7d1eaaf1cf20d1e9b425c8

    • SSDEEP

      96:fgf4G5PePLcpOR08klJrGPexDlsFcwVIuJEMxJfZUHY4dgkAoPexTqafkU9o6Ct4:fSBV/Smll4Nl9Wjqx9Q6

    Score
    3/10
    discovery
    behavioral21behavioral22

    • Target

      top flash to video.exe

    • Size

      1.6MB

    • MD5

      2aa4d2caa73ed5160cc34fba921236c1

    • SHA1

      022d065ddb70ffa3bba898e183179772d7c484fd

    • SHA256

      5e5ae825b31fa0863f8a3055379306e20ac9f3c554f121f4f0c29430f79e51cf

    • SHA512

      3a3b0104b0005d1a158727ca51a797255616af0365090921db58cc70ec3a4a2cadb9a7630384af4cb7a5b134a9de5217bb7499cb02d13c9c92f6124a127fd7fd

    • SSDEEP

      24576:G1tYL4dVpWK5GYFHGgGfqa2B7yzzLP0DTXYWCs/tSVmzvIPUrsj2WnkIdINwByd6:G1t5GYEaaD/YTKsVSVHPfnkII96

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral23behavioral24

    • Target

      uninst.exe

    • Size

      59KB

    • MD5

      34f6d44a2d291218eea56b97d44a9d50

    • SHA1

      c61543a79a94691ee5a56106e55f3c61c40796b6

    • SHA256

      f7109f2743afb1026c740da41952824e1a96600a1deebed4393d59eb0a53de9e

    • SHA512

      a830f72b1c1250c3c8e94a35ab095cd0fa85021cd5862662753877802dca0a80b178a8d678b8295c87d70b10132f307556791d90c5058159447702cfc9cefaab

    • SSDEEP

      768:7e3PFaDVyOQgljLDKRJyM3BmsHzSB4us/wJJajCP8nn3gYRNBy/04bfznLNC/ML/:K3cpyORJLuB4P4AJJpYRN4DvThqtHK

    Score
    8/10
    discovery

    • Drops file in Drivers directory

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral25behavioral26

    • Target

      ּ.URL

    • Size

      48B

    • MD5

      7ac41ca2e3fdd3f6a39697da02add77b

    • SHA1

      0c5dc143dd4c468d9c467afad62d3eac83c192bb

    • SHA256

      942d97f83a80d7ec955a96a50fd80bcfd7ba3b6226974832a8e2eec2cd77540d

    • SHA512

      4905d0b570e2d1cb0dbdaec42a133ba6fd3101e0cfc8af7f2a2fe51bf2faafb227034620a1228f9ed5d22723e55e9c2c94944adb07bc2172ffae0c571c11a89a

    Score
    1/10
    behavioral27behavioral28

    • Target

      ⷴ.url

    • Size

      263B

    • MD5

      5bf35719f0479aa4a3dbdcd71fd07649

    • SHA1

      eff4ac9350cae4fbdb0ea5f902caa6ec8ec90f28

    • SHA256

      e3d6ca0ffc17ed4f96bbbf2c4fd5811c2503d81324514a721326c19f58c943fb

    • SHA512

      152904bccd2bb3238197b3423dfd31ae7639e286b4d63e9e9eeccb8af70f83e8514dee15b3b41f2ec1750338aa21ac50a62c03e78429d2eb3d65b6fa57d8e690

    Score
    1/10
    behavioral29behavioral30

MITRE ATT&CK Enterprise v15

Tasks

static1

upx
Score
7/10

behavioral1

discovery
Score
7/10

behavioral2

discovery
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discoveryupx
Score
5/10

behavioral14

discoveryupx
Score
5/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

modiloaderdiscoverytrojan
Score
10/10

behavioral24

modiloaderdiscoverytrojan
Score
10/10

behavioral25

discovery
Score
8/10

behavioral26

discovery
Score
8/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10