Overview

overview

10

Static

static

3

d98cf17a94...18.exe

windows7-x64

10

d98cf17a94...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d98cf17a946979949dcdadf337a8cc38_JaffaCakes118

  • Size

    546KB

  • Sample

    241209-pbg4va1pfj

  • MD5

    d98cf17a946979949dcdadf337a8cc38

  • SHA1

    d47368e55eb7069b3a075ec0c5f17f4fc83c524b

  • SHA256

    e54a56cb1bf8a5eba886cb79a4dc81763c62b187100af78124384d2c38e21691

  • SHA512

    5d2eb0bba0613e1b5b244de6f4e2ec989bb26902d59daae611f2f1ff4046fd4f9bcb877b116094e7e3063af83bc78b08f19f580c99e3ca851a329c2b7d55fcab

  • SSDEEP

    12288:fsja8ws/s7gg5fr74Sne8o0/eaTWCMHTV/XJ6RoPtCaCcbnpqhh:38Jg5D7JLrLaJ/XERoP+ctqhh

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      d98cf17a946979949dcdadf337a8cc38_JaffaCakes118

    • Size

      546KB

    • MD5

      d98cf17a946979949dcdadf337a8cc38

    • SHA1

      d47368e55eb7069b3a075ec0c5f17f4fc83c524b

    • SHA256

      e54a56cb1bf8a5eba886cb79a4dc81763c62b187100af78124384d2c38e21691

    • SHA512

      5d2eb0bba0613e1b5b244de6f4e2ec989bb26902d59daae611f2f1ff4046fd4f9bcb877b116094e7e3063af83bc78b08f19f580c99e3ca851a329c2b7d55fcab

    • SSDEEP

      12288:fsja8ws/s7gg5fr74Sne8o0/eaTWCMHTV/XJ6RoPtCaCcbnpqhh:38Jg5D7JLrLaJ/XERoP+ctqhh

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks