Overview

overview

10

Static

static

3

d262e452b5...18.exe

windows7-x64

10

d262e452b5...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d262e452b5ccc854ec2139789d5ea2c5_JaffaCakes118

  • Size

    240KB

  • Sample

    241207-pdkbzsxlel

  • MD5

    d262e452b5ccc854ec2139789d5ea2c5

  • SHA1

    3f5a41a2d8ca74cfaca3b62abdaf3f071b727a9f

  • SHA256

    89931042a06ff2b39ff9756219a966b42bb51294feaf2e06ca3f7be36d847ca1

  • SHA512

    a210c707a325dd78f2916138acb0613cdc4ed16dd42529dce45634b35295d8de2e64b5a2c485659ce9546510fec97978ebfcead537f7c909d677d6c819093bb5

  • SSDEEP

    3072:qFU3t+Xo6Yvr12cBc0647qek04/IT5omSsX7k27Mvhm3XDcO/7RyRqGh0X8A4qZK:qXYDEcS147ql0mKrwoMJ8DXg0Me

Score
10/10
modiloaderdefense_evasiondiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      d262e452b5ccc854ec2139789d5ea2c5_JaffaCakes118

    • Size

      240KB

    • MD5

      d262e452b5ccc854ec2139789d5ea2c5

    • SHA1

      3f5a41a2d8ca74cfaca3b62abdaf3f071b727a9f

    • SHA256

      89931042a06ff2b39ff9756219a966b42bb51294feaf2e06ca3f7be36d847ca1

    • SHA512

      a210c707a325dd78f2916138acb0613cdc4ed16dd42529dce45634b35295d8de2e64b5a2c485659ce9546510fec97978ebfcead537f7c909d677d6c819093bb5

    • SSDEEP

      3072:qFU3t+Xo6Yvr12cBc0647qek04/IT5omSsX7k27Mvhm3XDcO/7RyRqGh0X8A4qZK:qXYDEcS147ql0mKrwoMJ8DXg0Me

    Score
    10/10
    modiloaderdefense_evasiondiscoveryevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Impair Defenses: Safe Mode Boot

      defense_evasion

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks