Overview

overview

10

Static

static

3

fa4a3f11a4...18.exe

windows7-x64

10

fa4a3f11a4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa4a3f11a4f6dec0995b6d08692a175f_JaffaCakes118

  • Size

    365KB

  • Sample

    241218-f7j4msvpbw

  • MD5

    fa4a3f11a4f6dec0995b6d08692a175f

  • SHA1

    61a13d2666b99c623976d5dede5a8cbbedc88059

  • SHA256

    d7c6d8cc6dbe2fb4072756b4c58427303ad62e044e2b9142fdcd3f2dac61f31d

  • SHA512

    311c31a70a52899ce9225ea9a4ef475126dc2becfab3be87e3711e163578e9dceb6cd5466f8553165fe9a59281b0fd464814e601b4616dc6b9a6be7aa26ac4b7

  • SSDEEP

    6144:B/0uoDXyB5M+4MMLJI0IcaVY8ijYMi9rWYKQc8OA8FNuw/g4Pwkn5vjOL:BJgip4nK1pHiYHhKQSZJ1Pwkn5vjk

Score
10/10
modiloaderdiscoverypersistencetrojanvmprotect

Malware Config

Targets

    • Target

      fa4a3f11a4f6dec0995b6d08692a175f_JaffaCakes118

    • Size

      365KB

    • MD5

      fa4a3f11a4f6dec0995b6d08692a175f

    • SHA1

      61a13d2666b99c623976d5dede5a8cbbedc88059

    • SHA256

      d7c6d8cc6dbe2fb4072756b4c58427303ad62e044e2b9142fdcd3f2dac61f31d

    • SHA512

      311c31a70a52899ce9225ea9a4ef475126dc2becfab3be87e3711e163578e9dceb6cd5466f8553165fe9a59281b0fd464814e601b4616dc6b9a6be7aa26ac4b7

    • SSDEEP

      6144:B/0uoDXyB5M+4MMLJI0IcaVY8ijYMi9rWYKQc8OA8FNuw/g4Pwkn5vjOL:BJgip4nK1pHiYHhKQSZJ1Pwkn5vjk

    Score
    10/10
    modiloaderdiscoverypersistencetrojanvmprotect

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks