General

  • Target

    d166000940f80cfaf8198ed373146657_JaffaCakes118

  • Size

    501KB

  • Sample

    241207-jv697atkfy

  • MD5

    d166000940f80cfaf8198ed373146657

  • SHA1

    badaa1e02bd0d47b2bd2ebf4f6f0d0a9079933dd

  • SHA256

    df125d50864d4b5d90012e818d360ca50baa2bff4290814d83b80725105cc0b0

  • SHA512

    1847f038d3c03ba33108a5d23aeb7af7c4e09a226b5986a6ec45bc86962e4eee8ff1b01a84cc50d7861787a3b1e597441171908328509f6cb670030c941e50bf

  • SSDEEP

    12288:48IPaBwWrgTYcAEp1c2obY7WvstfKG6FXtNL:48IPavgxocIst96pt1

Malware Config

Targets

    • Target

      d166000940f80cfaf8198ed373146657_JaffaCakes118

    • Size

      501KB

    • MD5

      d166000940f80cfaf8198ed373146657

    • SHA1

      badaa1e02bd0d47b2bd2ebf4f6f0d0a9079933dd

    • SHA256

      df125d50864d4b5d90012e818d360ca50baa2bff4290814d83b80725105cc0b0

    • SHA512

      1847f038d3c03ba33108a5d23aeb7af7c4e09a226b5986a6ec45bc86962e4eee8ff1b01a84cc50d7861787a3b1e597441171908328509f6cb670030c941e50bf

    • SSDEEP

      12288:48IPaBwWrgTYcAEp1c2obY7WvstfKG6FXtNL:48IPavgxocIst96pt1

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Modiloader family

    • ModiLoader Second Stage

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks