Overview

overview

10

Static

static

3

ef431b38bc...18.exe

windows7-x64

10

ef431b38bc...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ef431b38bcaef215a7149129f6a0ccf2_JaffaCakes118

  • Size

    321KB

  • Sample

    241214-r16vlsvpay

  • MD5

    ef431b38bcaef215a7149129f6a0ccf2

  • SHA1

    f359f942294ca1b494d59aef3fed4bce24b28289

  • SHA256

    e36fd75619157e92cf5e282f24fcc333bd46da5e156f1f3b1256a2fecd952550

  • SHA512

    6faafbd485f771a1687d9b2d410cb28a137753b6a7897dde6c106cc405f25a169eccd413b9c8a122d0da6b388dfa4b8f899953af0764c404f929763e8775990f

  • SSDEEP

    6144:Gbpx5vy4HIopUfLBhSVl4D4eakMvN3ALMXqZc8a9QxTsYyEc6ND2N8TMUZbCwB:c5q4HjpUfLol4FKvNwLnSpqTfyj6529U

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      ef431b38bcaef215a7149129f6a0ccf2_JaffaCakes118

    • Size

      321KB

    • MD5

      ef431b38bcaef215a7149129f6a0ccf2

    • SHA1

      f359f942294ca1b494d59aef3fed4bce24b28289

    • SHA256

      e36fd75619157e92cf5e282f24fcc333bd46da5e156f1f3b1256a2fecd952550

    • SHA512

      6faafbd485f771a1687d9b2d410cb28a137753b6a7897dde6c106cc405f25a169eccd413b9c8a122d0da6b388dfa4b8f899953af0764c404f929763e8775990f

    • SSDEEP

      6144:Gbpx5vy4HIopUfLBhSVl4D4eakMvN3ALMXqZc8a9QxTsYyEc6ND2N8TMUZbCwB:c5q4HjpUfLol4FKvNwLnSpqTfyj6529U

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks