Overview

overview

10

Static

static

3

d74f54b77e...18.exe

windows7-x64

10

d74f54b77e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d74f54b77e0c4fed6b92e5c05a25894b_JaffaCakes118

  • Size

    294KB

  • Sample

    241208-qw7exazmdq

  • MD5

    d74f54b77e0c4fed6b92e5c05a25894b

  • SHA1

    c1fe5e83e96b66a99283635a8680dc166848a74b

  • SHA256

    f1d856023c3980c83cc8e15bcb962db208ca8d7112c58b5e6df6279a36073a09

  • SHA512

    50172b652c7e5f5b851dbbc4ef4c9ca42770303d7e65575d35463ad7e80a1621def0e26e75977f7b460b4a79734e48d6f91b23ad3a1fe0ec6fa2b8417e562dc6

  • SSDEEP

    6144:vVrhP9RbTRXkqaSFJoFJX+TWgUW4iRLA3zm+2tfvCuZwo/Zk/6hFBR47396xrZk:LP/bT5kqa8MJOWCAYvThkR3oxrO

Score
10/10
modiloaderdefense_evasiondiscoverypersistencetrojan

Malware Config

Targets

    • Target

      d74f54b77e0c4fed6b92e5c05a25894b_JaffaCakes118

    • Size

      294KB

    • MD5

      d74f54b77e0c4fed6b92e5c05a25894b

    • SHA1

      c1fe5e83e96b66a99283635a8680dc166848a74b

    • SHA256

      f1d856023c3980c83cc8e15bcb962db208ca8d7112c58b5e6df6279a36073a09

    • SHA512

      50172b652c7e5f5b851dbbc4ef4c9ca42770303d7e65575d35463ad7e80a1621def0e26e75977f7b460b4a79734e48d6f91b23ad3a1fe0ec6fa2b8417e562dc6

    • SSDEEP

      6144:vVrhP9RbTRXkqaSFJoFJX+TWgUW4iRLA3zm+2tfvCuZwo/Zk/6hFBR47396xrZk:LP/bT5kqa8MJOWCAYvThkR3oxrO

    Score
    10/10
    modiloaderdefense_evasiondiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

      defense_evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks