Overview

overview

10

Static

static

3

db5b0c1e4a...18.exe

windows7-x64

10

db5b0c1e4a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    db5b0c1e4a2ba742d68a7ca9d779ba91_JaffaCakes118

  • Size

    132KB

  • Sample

    241209-y22evazlcv

  • MD5

    db5b0c1e4a2ba742d68a7ca9d779ba91

  • SHA1

    618b86859310084985a2051d511682483767e7ee

  • SHA256

    414c5a67a6f520797898987b595f610523839194d89f6b3bfb172a1aa40183c9

  • SHA512

    0dba1a7ba53ad5d08cd20bd17bc4556f0c9597cd9fadb91aba5c44d28cf5529a2afdf1753ceb3aaabb2208f1b296b15288f7ada27601610c1bb55f580169ebcd

  • SSDEEP

    3072:aND6ySoWZRz+q6lZyETxrqRtBcY/BBS6ghFuutfL3Vg8UodlJI:Auh+TKaqREApgt7g8tlJI

Score
10/10
modiloaderdiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      db5b0c1e4a2ba742d68a7ca9d779ba91_JaffaCakes118

    • Size

      132KB

    • MD5

      db5b0c1e4a2ba742d68a7ca9d779ba91

    • SHA1

      618b86859310084985a2051d511682483767e7ee

    • SHA256

      414c5a67a6f520797898987b595f610523839194d89f6b3bfb172a1aa40183c9

    • SHA512

      0dba1a7ba53ad5d08cd20bd17bc4556f0c9597cd9fadb91aba5c44d28cf5529a2afdf1753ceb3aaabb2208f1b296b15288f7ada27601610c1bb55f580169ebcd

    • SSDEEP

      3072:aND6ySoWZRz+q6lZyETxrqRtBcY/BBS6ghFuutfL3Vg8UodlJI:Auh+TKaqREApgt7g8tlJI

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks