Overview

overview

10

Static

static

3

db16893f63...18.exe

windows7-x64

10

db16893f63...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    db16893f63cefae7ba34707685c0a4ad_JaffaCakes118

  • Size

    289KB

  • Sample

    241209-xrcs3asnfl

  • MD5

    db16893f63cefae7ba34707685c0a4ad

  • SHA1

    cc54bc3311910573dc782e414b3d5e13371cf2dc

  • SHA256

    af08e293d2d0f042fcb5a44ec84d72a65b4a13a3ae4917ea312cee57ef148f97

  • SHA512

    ffa9c55bf91e57f8f208b69e03fc1d5e1911555727541d1f87a575b82d54201b5ac14af6b201e1172f3612bcd4d1aa15eca6ef1c1427a8f3901e961f83d29634

  • SSDEEP

    6144:Xkjoa4NCb6kIuy/w0AggOVMeKEyIYmoxdzy8xTVOrlVdck3Gyvz:Xeoa4bsowc1qeKE+i8xTVOrh2Uz

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      db16893f63cefae7ba34707685c0a4ad_JaffaCakes118

    • Size

      289KB

    • MD5

      db16893f63cefae7ba34707685c0a4ad

    • SHA1

      cc54bc3311910573dc782e414b3d5e13371cf2dc

    • SHA256

      af08e293d2d0f042fcb5a44ec84d72a65b4a13a3ae4917ea312cee57ef148f97

    • SHA512

      ffa9c55bf91e57f8f208b69e03fc1d5e1911555727541d1f87a575b82d54201b5ac14af6b201e1172f3612bcd4d1aa15eca6ef1c1427a8f3901e961f83d29634

    • SSDEEP

      6144:Xkjoa4NCb6kIuy/w0AggOVMeKEyIYmoxdzy8xTVOrlVdck3Gyvz:Xeoa4bsowc1qeKE+i8xTVOrh2Uz

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks