Overview

overview

10

Static

static

3

e471066ef4...18.exe

windows7-x64

10

e471066ef4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e471066ef455938d850e3f4b9f4e23c4_JaffaCakes118

  • Size

    588KB

  • Sample

    241212-dsmvwatjhp

  • MD5

    e471066ef455938d850e3f4b9f4e23c4

  • SHA1

    f9595bc06266cd8177fd53115059401e7f900c96

  • SHA256

    27f69011647f15e78f3dd669b1ebad116f31d74721ea792655a475a0098f0b89

  • SHA512

    8f5074f1b6dff218de0f9ce1ccab80e8d0fed5a6e4d0ea682f05bb851ebd97aa21da7c8bc195f6b90d55e93b0e5eba94aade5ef4a5d4c7802682e945ab9a8e7b

  • SSDEEP

    12288:U1FIAhwASC2AFCYG9+LbRQ+RhKr5rZnlBjRgSu3Q8WnNec:8r2ASCt7vJQ+RhKNJlhRgSb8WNP

Score
10/10
modiloaderdiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      e471066ef455938d850e3f4b9f4e23c4_JaffaCakes118

    • Size

      588KB

    • MD5

      e471066ef455938d850e3f4b9f4e23c4

    • SHA1

      f9595bc06266cd8177fd53115059401e7f900c96

    • SHA256

      27f69011647f15e78f3dd669b1ebad116f31d74721ea792655a475a0098f0b89

    • SHA512

      8f5074f1b6dff218de0f9ce1ccab80e8d0fed5a6e4d0ea682f05bb851ebd97aa21da7c8bc195f6b90d55e93b0e5eba94aade5ef4a5d4c7802682e945ab9a8e7b

    • SSDEEP

      12288:U1FIAhwASC2AFCYG9+LbRQ+RhKr5rZnlBjRgSu3Q8WnNec:8r2ASCt7vJQ+RhKNJlhRgSb8WNP

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks