Overview

overview

10

Static

static

10

ef95b971af...18.exe

windows7-x64

1

ef95b971af...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ef95b971af515ee6ebc8b100883d441c_JaffaCakes118

  • Size

    79KB

  • Sample

    241214-tjwz7aypgl

  • MD5

    ef95b971af515ee6ebc8b100883d441c

  • SHA1

    5e6e51cb03a706eb6e606819d716a42730f4ad12

  • SHA256

    aeb34d7641fa1c34c1ca5c9e8bbb4210eb53c3bca02b06cee8bda3d67cb77ff4

  • SHA512

    313b82b4d8b627edd3c83dfd79095eef92fe572870ca99a7b8218176e244f564e50df13319b894cca5fb936f142d8396109a4e05fcdefa1ab74b323b0e85af46

  • SSDEEP

    1536:1oQQcI3QxNXG07aecqOQbB3fQc8Pfymg0yxpByxjuE:1oOIQXG0cyVQtPfymg0soxyE

Score
10/10
modiloaderaspackv2discoverypersistencetrojan

Malware Config

Targets

    • Target

      ef95b971af515ee6ebc8b100883d441c_JaffaCakes118

    • Size

      79KB

    • MD5

      ef95b971af515ee6ebc8b100883d441c

    • SHA1

      5e6e51cb03a706eb6e606819d716a42730f4ad12

    • SHA256

      aeb34d7641fa1c34c1ca5c9e8bbb4210eb53c3bca02b06cee8bda3d67cb77ff4

    • SHA512

      313b82b4d8b627edd3c83dfd79095eef92fe572870ca99a7b8218176e244f564e50df13319b894cca5fb936f142d8396109a4e05fcdefa1ab74b323b0e85af46

    • SSDEEP

      1536:1oQQcI3QxNXG07aecqOQbB3fQc8Pfymg0yxpByxjuE:1oOIQXG0cyVQtPfymg0soxyE

    Score
    10/10
    modiloaderaspackv2discoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks