Overview

overview

10

Static

static

3

cfeb3a72af...18.exe

windows7-x64

10

cfeb3a72af...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cfeb3a72af97a396bb361f243d15abaf_JaffaCakes118

  • Size

    569KB

  • Sample

    241207-bdk2maxlfz

  • MD5

    cfeb3a72af97a396bb361f243d15abaf

  • SHA1

    794e1fc68e02956a1bf8b1ece0361075f44e6485

  • SHA256

    099440391b25c625dfe3c631b0117ff0e4bb00d4b11d5de791cfd7d1a6abb135

  • SHA512

    820f7c41b61bfede862c7e11350e36c31dc900fbf8bae3ced41ddb42925a40752a6158cfb271e509aafd34cae3f11b0c05fe83a74158593317deb72489447eb2

  • SSDEEP

    12288:jDI3c4C1AWQo/mC0F3Z4mxx9nf4SOVNs4wmpag:jDIo1AWNmC0QmXpASqLpr

Score
10/10
modiloaderdefense_evasiondiscoverypersistencetrojan

Malware Config

Targets

    • Target

      cfeb3a72af97a396bb361f243d15abaf_JaffaCakes118

    • Size

      569KB

    • MD5

      cfeb3a72af97a396bb361f243d15abaf

    • SHA1

      794e1fc68e02956a1bf8b1ece0361075f44e6485

    • SHA256

      099440391b25c625dfe3c631b0117ff0e4bb00d4b11d5de791cfd7d1a6abb135

    • SHA512

      820f7c41b61bfede862c7e11350e36c31dc900fbf8bae3ced41ddb42925a40752a6158cfb271e509aafd34cae3f11b0c05fe83a74158593317deb72489447eb2

    • SSDEEP

      12288:jDI3c4C1AWQo/mC0F3Z4mxx9nf4SOVNs4wmpag:jDIo1AWNmC0QmXpASqLpr

    Score
    10/10
    modiloaderdefense_evasiondiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies WinLogon for persistence

      persistence

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Deletes itself

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks