Overview

overview

10

Static

static

3

d3d321a4d1...18.exe

windows7-x64

10

d3d321a4d1...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d3d321a4d1f57f4e734a3fda4cd38f8a_JaffaCakes118

  • Size

    1.9MB

  • Sample

    241207-1ypyra1pgp

  • MD5

    d3d321a4d1f57f4e734a3fda4cd38f8a

  • SHA1

    66482b07d2bd53cdce8e7e4522b08ece8b45e7a7

  • SHA256

    0e564d5bba526d9b01e83dd77ed60353bff5a6225ef13e85518c97fe04ac7641

  • SHA512

    5b68a88f1de6fbfe2f0f3af157e1def909cb5d9850b8c8f3014e14e5ca2fe3c8ca74973bcc93dba9b6a02c49b9032ba7b41fed36935ca83c97a2d38b4eedd233

  • SSDEEP

    49152:Ivz6YOgiqFhQ8PdC+fzlXybNtOCDytkiYEO5infAhx6:o+YgAhzMS5y2UyOiyinb

Score
10/10
modiloaderdefense_evasiondiscoverypersistencetrojan

Malware Config

Targets

    • Target

      d3d321a4d1f57f4e734a3fda4cd38f8a_JaffaCakes118

    • Size

      1.9MB

    • MD5

      d3d321a4d1f57f4e734a3fda4cd38f8a

    • SHA1

      66482b07d2bd53cdce8e7e4522b08ece8b45e7a7

    • SHA256

      0e564d5bba526d9b01e83dd77ed60353bff5a6225ef13e85518c97fe04ac7641

    • SHA512

      5b68a88f1de6fbfe2f0f3af157e1def909cb5d9850b8c8f3014e14e5ca2fe3c8ca74973bcc93dba9b6a02c49b9032ba7b41fed36935ca83c97a2d38b4eedd233

    • SSDEEP

      49152:Ivz6YOgiqFhQ8PdC+fzlXybNtOCDytkiYEO5infAhx6:o+YgAhzMS5y2UyOiyinb

    Score
    10/10
    modiloaderdefense_evasiondiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

      defense_evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks