Overview

overview

10

Static

static

3

Illy_Deact...ed.exe

windows7-x64

10

Illy_Deact...ed.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed23d01d2ee2f0a59c69cec8a1feb905_JaffaCakes118

  • Size

    232KB

  • Sample

    241213-23y8nasnel

  • MD5

    ed23d01d2ee2f0a59c69cec8a1feb905

  • SHA1

    b999d63aa33b20cf41cf60dc7ebb600ef81ce8f4

  • SHA256

    b26eb01f6ceedd46a8d8d9396cde9fad80ac38fbb0ba2a818e7e39ba53a3c46a

  • SHA512

    66012fc8e8de0cf5b3df5640aa81b89433118413e2132f3328e95eea27b588d0c9f3d1925763eef4ae6190e32c9478053efc1c1140cee8a5c9fccd85be2ce097

  • SSDEEP

    3072:o9Ave11jChFjwm5QD+YByNHFTxBWYHrLV0PDzHZPfo6xcbXFbaYCSm6iArHhY:qA0N0okNJWYL65PfFcbX5ajES

Score
10/10
modiloaderdiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      Illy_Deactovator_crackd_by__ghost_/Illy Deactovator crackd by VAMPAIRE/cracked.exe

    • Size

      268KB

    • MD5

      acfb0633530a15ff5a32e078b2def812

    • SHA1

      4920d9cd7db08e4b455e91a3930b6c7a862bf2c6

    • SHA256

      e31ec0cb989c40190f0bfe96ac42d564cc4f6a5227cf319a2f4f82d313cf1ca3

    • SHA512

      612ad0d4da0870f871f9bb94c6f4e4dbca952e246c9d3f30423b0205a41a51c269377369ea2e4a96ee11d8676fd4cc35adbe7a5446342ce3ad904f7e29085b95

    • SSDEEP

      6144:cjbeiQjLnXIHdwl+aXNb9bsmyZO+kzK0g:cuTsKp9tIO+YK

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks