Overview

overview

10

Static

static

3

ef297a5739...18.exe

windows7-x64

10

ef297a5739...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ef297a5739071a0553b1f71b25baa1ce_JaffaCakes118

  • Size

    647KB

  • Sample

    241214-rjm16swnbq

  • MD5

    ef297a5739071a0553b1f71b25baa1ce

  • SHA1

    3a1d60be615b106ce13ac79a8aaf6d948f1fecc0

  • SHA256

    cebea98392ba05267c40102c63d91a9584b9c9789a25d8f2c4e813b10689de40

  • SHA512

    2d3c6f17f40c1a94adc7db1d4a7f26b5675ae276586df0c5dad6fd6aefa1fb5c41a50f7dfb00fb09479a2a995234c479b6a469cb483e40b10fa167de88cf2fe3

  • SSDEEP

    12288:Q+s8PiDoWbGhKU/TQbY94li3skjk2VaABR1DopDOm7YdKIIIq/fh:Q+s8JWboKULQbzi82TVaSopimBjIqXh

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      ef297a5739071a0553b1f71b25baa1ce_JaffaCakes118

    • Size

      647KB

    • MD5

      ef297a5739071a0553b1f71b25baa1ce

    • SHA1

      3a1d60be615b106ce13ac79a8aaf6d948f1fecc0

    • SHA256

      cebea98392ba05267c40102c63d91a9584b9c9789a25d8f2c4e813b10689de40

    • SHA512

      2d3c6f17f40c1a94adc7db1d4a7f26b5675ae276586df0c5dad6fd6aefa1fb5c41a50f7dfb00fb09479a2a995234c479b6a469cb483e40b10fa167de88cf2fe3

    • SSDEEP

      12288:Q+s8PiDoWbGhKU/TQbY94li3skjk2VaABR1DopDOm7YdKIIIq/fh:Q+s8JWboKULQbzi82TVaSopimBjIqXh

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks