Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

e189768c39...18.exe

windows7-x64

10

e189768c39...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e189768c394785e0604c98b9dad150d9_JaffaCakes118

  • Size

    180KB

  • Sample

    241211-p17e2axpal

  • MD5

    e189768c394785e0604c98b9dad150d9

  • SHA1

    a60a6b7b228ea4c680ef49f46ffd385a43e66b8d

  • SHA256

    dc1e362c5a4d1f149b899055345e1918c35dc17ebfcd3586739e9f1820270138

  • SHA512

    427776eafc10c2ced5e9f074d00b306b7ea840daf301f6c0e2b0d04bc398829c243c8cb094482057e86064920641ab145621311f71389d0e4ab31ca19fdc0ef4

  • SSDEEP

    3072:IRorUPEGTTYJ8J19b6ue97KlQ1YUhSTJqIoH5vcuy1qiMwP0bCbX:S3PEG/Y2JGL97j1YUhSiZvcuy/MwPOkX

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      e189768c394785e0604c98b9dad150d9_JaffaCakes118

    • Size

      180KB

    • MD5

      e189768c394785e0604c98b9dad150d9

    • SHA1

      a60a6b7b228ea4c680ef49f46ffd385a43e66b8d

    • SHA256

      dc1e362c5a4d1f149b899055345e1918c35dc17ebfcd3586739e9f1820270138

    • SHA512

      427776eafc10c2ced5e9f074d00b306b7ea840daf301f6c0e2b0d04bc398829c243c8cb094482057e86064920641ab145621311f71389d0e4ab31ca19fdc0ef4

    • SSDEEP

      3072:IRorUPEGTTYJ8J19b6ue97KlQ1YUhSTJqIoH5vcuy1qiMwP0bCbX:S3PEG/Y2JGL97j1YUhSiZvcuy/MwPOkX

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks