Overview

overview

10

Static

static

5

ddcf53ebfd...18.exe

windows7-x64

10

ddcf53ebfd...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ddcf53ebfdbfc1b37fb764499874fb95_JaffaCakes118

  • Size

    357KB

  • Sample

    241210-j3cesaznhy

  • MD5

    ddcf53ebfdbfc1b37fb764499874fb95

  • SHA1

    09a354c1d0e4944788e067a81d713699289684de

  • SHA256

    1a137a5996a371f46ebb1876ad2f20e73a85a5ce71b3e18edf8682d4bedfeca5

  • SHA512

    18db3a75e1902371a8a0c8ce1817deba64cb5caa4a2e2ada526372485005dc4602629e81e1325967a7eeb446387001e5fb41e54db59df7053382a2ef00a29af4

  • SSDEEP

    6144:d/0uod9J+ztQbs9KFcaGEBY5NDXz/CZy1CjgZr2/qSx7HNYkvDHKpcMoCsVDob:dJ4J+ZQbscFcaRBY/jWy1CEMJYkslAVM

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      ddcf53ebfdbfc1b37fb764499874fb95_JaffaCakes118

    • Size

      357KB

    • MD5

      ddcf53ebfdbfc1b37fb764499874fb95

    • SHA1

      09a354c1d0e4944788e067a81d713699289684de

    • SHA256

      1a137a5996a371f46ebb1876ad2f20e73a85a5ce71b3e18edf8682d4bedfeca5

    • SHA512

      18db3a75e1902371a8a0c8ce1817deba64cb5caa4a2e2ada526372485005dc4602629e81e1325967a7eeb446387001e5fb41e54db59df7053382a2ef00a29af4

    • SSDEEP

      6144:d/0uod9J+ztQbs9KFcaGEBY5NDXz/CZy1CjgZr2/qSx7HNYkvDHKpcMoCsVDob:dJ4J+ZQbscFcaRBY/jWy1CEMJYkslAVM

    Score
    10/10
    modiloaderdiscoverypersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks