Overview

overview

10

Static

static

3

f3e0c7308f...18.exe

windows7-x64

10

f3e0c7308f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f3e0c7308f933365b61bb899ec2f2c43_JaffaCakes118

  • Size

    57KB

  • Sample

    241215-n278aatjcz

  • MD5

    f3e0c7308f933365b61bb899ec2f2c43

  • SHA1

    e1c651107b06ded92183b27e349a2e403574ad31

  • SHA256

    ce4625b42cf8f73d54b9c511fda207b68854debd8f2340d1d76113d9c03e893a

  • SHA512

    48407def86dccb9a570d156f64542af7371d11d7c0b22ec4815041cb940df38eeb7225b376e766356c7e1a6dcf7ac7b0554eb3ca1ec9628e5f9d29723df0653f

  • SSDEEP

    768:1IRbFW5xQO+/JVHRo71DuSV7pNzkoT7wxeu5qBcE7JhC4z/3KKnDw239q+/bZ43i:OsqFtRq1DuS5zhwxeuc5jzyPGmi

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      f3e0c7308f933365b61bb899ec2f2c43_JaffaCakes118

    • Size

      57KB

    • MD5

      f3e0c7308f933365b61bb899ec2f2c43

    • SHA1

      e1c651107b06ded92183b27e349a2e403574ad31

    • SHA256

      ce4625b42cf8f73d54b9c511fda207b68854debd8f2340d1d76113d9c03e893a

    • SHA512

      48407def86dccb9a570d156f64542af7371d11d7c0b22ec4815041cb940df38eeb7225b376e766356c7e1a6dcf7ac7b0554eb3ca1ec9628e5f9d29723df0653f

    • SSDEEP

      768:1IRbFW5xQO+/JVHRo71DuSV7pNzkoT7wxeu5qBcE7JhC4z/3KKnDw239q+/bZ43i:OsqFtRq1DuS5zhwxeuc5jzyPGmi

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks