Overview

overview

10

Static

static

10

d1dcb1cc3c...18.exe

windows7-x64

10

d1dcb1cc3c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d1dcb1cc3c84e685445102379ec8fce6_JaffaCakes118

  • Size

    1.3MB

  • Sample

    241207-l1j3ysxmdz

  • MD5

    d1dcb1cc3c84e685445102379ec8fce6

  • SHA1

    e325e40a43580389809e5c2edf02a68526892175

  • SHA256

    d6beec3ed1e0ad5f8201a5ecaf57f0f641639845476de46c5e3accfeca04fd3c

  • SHA512

    324bee3fa8274609206c7e23559e36d92a5ded11a5779acc4fb362bb3f4091008765c60c8fe473ba2fd93e61ac4a74a0b85e2604288048ecf85280ab389c52af

  • SSDEEP

    24576:IVzNOYbvGnLbqkHKiGlg09XxpquHdxTGMjn3WBdJHzppWWz6rreGfHiI:IVz0Yriq9W9uHdxTt3WpHOxrCID

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      d1dcb1cc3c84e685445102379ec8fce6_JaffaCakes118

    • Size

      1.3MB

    • MD5

      d1dcb1cc3c84e685445102379ec8fce6

    • SHA1

      e325e40a43580389809e5c2edf02a68526892175

    • SHA256

      d6beec3ed1e0ad5f8201a5ecaf57f0f641639845476de46c5e3accfeca04fd3c

    • SHA512

      324bee3fa8274609206c7e23559e36d92a5ded11a5779acc4fb362bb3f4091008765c60c8fe473ba2fd93e61ac4a74a0b85e2604288048ecf85280ab389c52af

    • SSDEEP

      24576:IVzNOYbvGnLbqkHKiGlg09XxpquHdxTGMjn3WBdJHzppWWz6rreGfHiI:IVz0Yriq9W9uHdxTt3WpHOxrCID

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks