Overview

overview

10

Static

static

3

ea35688c3b...18.exe

windows7-x64

10

ea35688c3b...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ea35688c3b4e97ec431e76990e1a5dd7_JaffaCakes118

  • Size

    969KB

  • Sample

    241213-gnfgsazpas

  • MD5

    ea35688c3b4e97ec431e76990e1a5dd7

  • SHA1

    ff461480c5b3988c61402def5b63b550c24191b1

  • SHA256

    b1f091fde258103951157138a8290ea701496e67533e8365f65a2f7010507e16

  • SHA512

    887503d47b0172c6148fedb6e73ca77005d4344b2a7575ec7263fd17c5805d6bb01f23671f718b613d3e765e518e357a6fcae04b39e448e28393434184235d58

  • SSDEEP

    24576:IjTBqNfbDLIEgMsuo6Fuajhz9iA018my9yp1QrdQgAsC:rNDDLIEUGFuaj1sA0xIOQpDk

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      ea35688c3b4e97ec431e76990e1a5dd7_JaffaCakes118

    • Size

      969KB

    • MD5

      ea35688c3b4e97ec431e76990e1a5dd7

    • SHA1

      ff461480c5b3988c61402def5b63b550c24191b1

    • SHA256

      b1f091fde258103951157138a8290ea701496e67533e8365f65a2f7010507e16

    • SHA512

      887503d47b0172c6148fedb6e73ca77005d4344b2a7575ec7263fd17c5805d6bb01f23671f718b613d3e765e518e357a6fcae04b39e448e28393434184235d58

    • SSDEEP

      24576:IjTBqNfbDLIEgMsuo6Fuajhz9iA018my9yp1QrdQgAsC:rNDDLIEUGFuaj1sA0xIOQpDk

    Score
    10/10
    modiloaderdiscoverypersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader First Stage

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks