Overview

overview

10

Static

static

3

e006c8ccd7...18.exe

windows7-x64

10

e006c8ccd7...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e006c8ccd7cace3710d68e8ca9d94d3b_JaffaCakes118

  • Size

    148KB

  • Sample

    241211-fxzrcaykgz

  • MD5

    e006c8ccd7cace3710d68e8ca9d94d3b

  • SHA1

    aef8da1fa3e3fec12dadf45d6537083d6f7cd823

  • SHA256

    95aedb06129dfa31c54795ba2ad7681102d4544297105b2cbd6adcccf870ba2b

  • SHA512

    1464f44ed8db28b48ab52438c84df0e8bf4dcb5257318ea15821eda4eca41fe5485791fc952fa890acde04bb7ca018cd26f99eaf728998ba5c92c7c9a13902ba

  • SSDEEP

    3072:muEmKFwvZvuwn7DijSNpPAIifm8FBsRu66yBCLRotWcrFDNqA7:B1K+BL7DijWl3b8XU6y41RWFZz7

Score
10/10
modiloaderdiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      e006c8ccd7cace3710d68e8ca9d94d3b_JaffaCakes118

    • Size

      148KB

    • MD5

      e006c8ccd7cace3710d68e8ca9d94d3b

    • SHA1

      aef8da1fa3e3fec12dadf45d6537083d6f7cd823

    • SHA256

      95aedb06129dfa31c54795ba2ad7681102d4544297105b2cbd6adcccf870ba2b

    • SHA512

      1464f44ed8db28b48ab52438c84df0e8bf4dcb5257318ea15821eda4eca41fe5485791fc952fa890acde04bb7ca018cd26f99eaf728998ba5c92c7c9a13902ba

    • SSDEEP

      3072:muEmKFwvZvuwn7DijSNpPAIifm8FBsRu66yBCLRotWcrFDNqA7:B1K+BL7DijWl3b8XU6y41RWFZz7

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks