Overview

overview

10

Static

static

3

c902e17a36...18.exe

windows7-x64

10

c902e17a36...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c902e17a361f31d15bddeaa2440e598e_JaffaCakes118

  • Size

    388KB

  • Sample

    241205-xq7xtaxmaz

  • MD5

    c902e17a361f31d15bddeaa2440e598e

  • SHA1

    e5bfde6265491c5877e2adb034ed9684b654b67f

  • SHA256

    e3eb2a837458abc3eedbdd2101ec2f1a2f1a2f0284eebff9e1b6f842d8e3984e

  • SHA512

    28bca0537cb4afdbef355fe6f7fb2760c7385411d8a6bb9d718927ad6b6c8cc63e74de05cd56a98a8211d19b923d8fce41561e1ffbce446bfa44567bb06f412c

  • SSDEEP

    6144:BjlW8Lu14DT0EfwiZXydOIpdPLnQJgHTgXfzwvSe85F2m1zSh4HBSh4H:fHMpEbAdOsdPDQjXcejw7

Score
10/10
modiloaderdiscoveryevasiontrojan

Malware Config

Targets

    • Target

      c902e17a361f31d15bddeaa2440e598e_JaffaCakes118

    • Size

      388KB

    • MD5

      c902e17a361f31d15bddeaa2440e598e

    • SHA1

      e5bfde6265491c5877e2adb034ed9684b654b67f

    • SHA256

      e3eb2a837458abc3eedbdd2101ec2f1a2f1a2f0284eebff9e1b6f842d8e3984e

    • SHA512

      28bca0537cb4afdbef355fe6f7fb2760c7385411d8a6bb9d718927ad6b6c8cc63e74de05cd56a98a8211d19b923d8fce41561e1ffbce446bfa44567bb06f412c

    • SSDEEP

      6144:BjlW8Lu14DT0EfwiZXydOIpdPLnQJgHTgXfzwvSe85F2m1zSh4HBSh4H:fHMpEbAdOsdPDQjXcejw7

    Score
    10/10
    modiloaderdiscoveryevasiontrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks