Overview

overview

10

Static

static

7

ed30d3e2c6...18.exe

windows7-x64

10

ed30d3e2c6...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed30d3e2c6164e47666b5dc6886a8c7f_JaffaCakes118

  • Size

    1.3MB

  • Sample

    241213-3b9ezssqcr

  • MD5

    ed30d3e2c6164e47666b5dc6886a8c7f

  • SHA1

    9c7dc8721c7f50241fd69ca901795356ba4fedb6

  • SHA256

    0f37baf16a9971b25fb758969a416bf83ccbf59bfb4d37ee6d8f78e9ae813c76

  • SHA512

    351ab80e0ba1cf8b6298cf9a642576823ca233eba9f8bb1615b8d7019353e35c76bbd38a04c210aff4673101f3b35b4595f2a096b702b4a5b7495dd1d0c823df

  • SSDEEP

    24576:1LmrHhTkIWzO7GNNJDNTajiP4oKCTjMMXg1pTWQ43/2Z:NmHhTkjOanKITY8gfTe2

Score
10/10
modiloaderdiscoveryevasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      ed30d3e2c6164e47666b5dc6886a8c7f_JaffaCakes118

    • Size

      1.3MB

    • MD5

      ed30d3e2c6164e47666b5dc6886a8c7f

    • SHA1

      9c7dc8721c7f50241fd69ca901795356ba4fedb6

    • SHA256

      0f37baf16a9971b25fb758969a416bf83ccbf59bfb4d37ee6d8f78e9ae813c76

    • SHA512

      351ab80e0ba1cf8b6298cf9a642576823ca233eba9f8bb1615b8d7019353e35c76bbd38a04c210aff4673101f3b35b4595f2a096b702b4a5b7495dd1d0c823df

    • SSDEEP

      24576:1LmrHhTkIWzO7GNNJDNTajiP4oKCTjMMXg1pTWQ43/2Z:NmHhTkjOanKITY8gfTe2

    Score
    10/10
    modiloaderdiscoveryevasionpersistencethemidatrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks