General

  • Target

    ca39502ea5ff04f687d90acda0de2221_JaffaCakes118

  • Size

    651KB

  • Sample

    241206-a73m4axlfq

  • MD5

    ca39502ea5ff04f687d90acda0de2221

  • SHA1

    df212838307e5fa625564b7518f14d201eb83a39

  • SHA256

    a440eea0dec517ba5e02240969ff1f18ff57837c8f15fc96f5220827524ffd2b

  • SHA512

    63cbc8751d186a54dbb54f2517662362eb03e494c94b5692aee8ac84889454c14ddbc3fdef2b393c95897501c54c19007cbdd51b1fb5734788c7a8f740e06463

  • SSDEEP

    12288:kpyZT1srCxu/mDwLRI6BxcDqp9aqCcajVuD3Z7BPQGMWYur0s0D:kUx1sjOD3SxcDDcNDqWYurL0

Malware Config

Targets

    • Target

      ca39502ea5ff04f687d90acda0de2221_JaffaCakes118

    • Size

      651KB

    • MD5

      ca39502ea5ff04f687d90acda0de2221

    • SHA1

      df212838307e5fa625564b7518f14d201eb83a39

    • SHA256

      a440eea0dec517ba5e02240969ff1f18ff57837c8f15fc96f5220827524ffd2b

    • SHA512

      63cbc8751d186a54dbb54f2517662362eb03e494c94b5692aee8ac84889454c14ddbc3fdef2b393c95897501c54c19007cbdd51b1fb5734788c7a8f740e06463

    • SSDEEP

      12288:kpyZT1srCxu/mDwLRI6BxcDqp9aqCcajVuD3Z7BPQGMWYur0s0D:kUx1sjOD3SxcDDcNDqWYurL0

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Modifies visiblity of hidden/system files in Explorer

    • Modiloader family

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Enumerates processes with tasklist

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.