Overview

overview

10

Static

static

3

d0609227b5...18.exe

windows7-x64

10

d0609227b5...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d0609227b5bf4fa7829e61e3ef44a2ce_JaffaCakes118

  • Size

    616KB

  • Sample

    241207-dqplpasrav

  • MD5

    d0609227b5bf4fa7829e61e3ef44a2ce

  • SHA1

    d511e9ee5021cd6fa7d86e10ce08c457ce7abd8e

  • SHA256

    e7f18fc8bcba2e12a856829c95ad5a88607b6ffa4ce081b046cc2107ca094981

  • SHA512

    346766ba01b863539cfa7666a5d045b6ac819a01273935636ab2126b4a5082feeb0ed953b29d9c83aa7617464ac240d3dcbff8a47173a87cc2c4f2309c7bcef2

  • SSDEEP

    12288:wEoamJ4b7x+36taaj0ZbQvls57TF3Z4mxxA/zll/EpM/Mv:wJamJoOALoQvlUfQmXkzM

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      d0609227b5bf4fa7829e61e3ef44a2ce_JaffaCakes118

    • Size

      616KB

    • MD5

      d0609227b5bf4fa7829e61e3ef44a2ce

    • SHA1

      d511e9ee5021cd6fa7d86e10ce08c457ce7abd8e

    • SHA256

      e7f18fc8bcba2e12a856829c95ad5a88607b6ffa4ce081b046cc2107ca094981

    • SHA512

      346766ba01b863539cfa7666a5d045b6ac819a01273935636ab2126b4a5082feeb0ed953b29d9c83aa7617464ac240d3dcbff8a47173a87cc2c4f2309c7bcef2

    • SSDEEP

      12288:wEoamJ4b7x+36taaj0ZbQvls57TF3Z4mxxA/zll/EpM/Mv:wJamJoOALoQvlUfQmXkzM

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks