Overview

overview

10

Static

static

10

f66b705f7d...18.exe

windows7-x64

10

f66b705f7d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f66b705f7d8277e6c0595e4555c9477d_JaffaCakes118

  • Size

    270KB

  • Sample

    241216-aqdyeawnck

  • MD5

    f66b705f7d8277e6c0595e4555c9477d

  • SHA1

    6e807130b1c4f9be31e72f4316d197c2bbe11484

  • SHA256

    c677408dc7d7111df1d28aa9f3cc02af08732e725491ea51fddf7b8d4a6b171e

  • SHA512

    9230e24fddf2262f406934544e72e966f3af371eba2c0b78450ca3a8699fbe19a8ca782660ff11de62d9aebdbe2532f7a7759561bdc780cb20de0039ec0c691b

  • SSDEEP

    6144:2G377xS2Vp2CeiorXdwTBgWx4v53HbpcCJJvH4:1r7xS2Vp6RwTyCobbJJvH4

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      f66b705f7d8277e6c0595e4555c9477d_JaffaCakes118

    • Size

      270KB

    • MD5

      f66b705f7d8277e6c0595e4555c9477d

    • SHA1

      6e807130b1c4f9be31e72f4316d197c2bbe11484

    • SHA256

      c677408dc7d7111df1d28aa9f3cc02af08732e725491ea51fddf7b8d4a6b171e

    • SHA512

      9230e24fddf2262f406934544e72e966f3af371eba2c0b78450ca3a8699fbe19a8ca782660ff11de62d9aebdbe2532f7a7759561bdc780cb20de0039ec0c691b

    • SSDEEP

      6144:2G377xS2Vp2CeiorXdwTBgWx4v53HbpcCJJvH4:1r7xS2Vp6RwTyCobbJJvH4

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks