Overview

overview

10

Static

static

3

e211a2f1b4...18.exe

windows7-x64

10

e211a2f1b4...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e211a2f1b4ca7346bee7dc2f14a7e7d5_JaffaCakes118

  • Size

    152KB

  • Sample

    241211-sqhwgaxrfy

  • MD5

    e211a2f1b4ca7346bee7dc2f14a7e7d5

  • SHA1

    b98db443285640f67e8cc5a0a434142c762d9e37

  • SHA256

    dcb35d1d4de318d4f72efb1d709174a14b552d7006347ee6b89ae889ab131daa

  • SHA512

    34cb119d79b4e37b36949bf0b17bc1bcc1bbf07435555fdde7e17fd6a0c87d0a0a429534413856ab004bd7737228977089e087211993b1f667aba454e5b2db1b

  • SSDEEP

    1536:c1DMz1DQvXLq6t7awFONecenlLnQHIG5R9c73P600t:9eGw9A0rC00t

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      e211a2f1b4ca7346bee7dc2f14a7e7d5_JaffaCakes118

    • Size

      152KB

    • MD5

      e211a2f1b4ca7346bee7dc2f14a7e7d5

    • SHA1

      b98db443285640f67e8cc5a0a434142c762d9e37

    • SHA256

      dcb35d1d4de318d4f72efb1d709174a14b552d7006347ee6b89ae889ab131daa

    • SHA512

      34cb119d79b4e37b36949bf0b17bc1bcc1bbf07435555fdde7e17fd6a0c87d0a0a429534413856ab004bd7737228977089e087211993b1f667aba454e5b2db1b

    • SSDEEP

      1536:c1DMz1DQvXLq6t7awFONecenlLnQHIG5R9c73P600t:9eGw9A0rC00t

    Score
    10/10
    modiloaderdiscoverypersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks