Overview

overview

10

Static

static

3

fbdbb31466...18.exe

windows7-x64

10

fbdbb31466...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fbdbb31466b09f812976925578b1e053_JaffaCakes118

  • Size

    776KB

  • Sample

    241218-rhb8aa1qgv

  • MD5

    fbdbb31466b09f812976925578b1e053

  • SHA1

    e7a204ec8cff2ca0e430656dcec8d1819b8b0618

  • SHA256

    8f77ef7c38ba8d72c7f1fc411801c7b7c5b42d7a0f7c877db8624f8e8113eb39

  • SHA512

    831a36ac984ede03b3b6e9d482b179ce9f49f67b5258bd4e809f0f96a82eb962cf1e2d096ed0cf7ff72005246c6b6040c506e152cb4b178b4d2b29052bc5f2ba

  • SSDEEP

    12288:ywtYgRM3k33tUwRyz52ccrFa0vhPROrliSajsBB0u0b/bnwgc:rtYgRIk33NRyF2hrdvjOr70zbwgc

Score
10/10
modiloaderdefense_evasiondiscoverypersistencetrojan

Malware Config

Targets

    • Target

      fbdbb31466b09f812976925578b1e053_JaffaCakes118

    • Size

      776KB

    • MD5

      fbdbb31466b09f812976925578b1e053

    • SHA1

      e7a204ec8cff2ca0e430656dcec8d1819b8b0618

    • SHA256

      8f77ef7c38ba8d72c7f1fc411801c7b7c5b42d7a0f7c877db8624f8e8113eb39

    • SHA512

      831a36ac984ede03b3b6e9d482b179ce9f49f67b5258bd4e809f0f96a82eb962cf1e2d096ed0cf7ff72005246c6b6040c506e152cb4b178b4d2b29052bc5f2ba

    • SSDEEP

      12288:ywtYgRM3k33tUwRyz52ccrFa0vhPROrliSajsBB0u0b/bnwgc:rtYgRIk33NRyF2hrdvjOr70zbwgc

    Score
    10/10
    modiloaderdefense_evasiondiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

      defense_evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks