General
-
Target
fc12d5b309f5090cc04ae5a8aea31c5a_JaffaCakes118
-
Size
173KB
-
Sample
241218-sq5egatkes
-
MD5
fc12d5b309f5090cc04ae5a8aea31c5a
-
SHA1
0fa6b9ab2032dc01e5a2881b8610af5dd08bec46
-
SHA256
123f5a6eb28a7e7936a67234374dbc4519cb1f96b1378af2883a51d6e605fb85
-
SHA512
3238cbe92132472138d4f432044bfb077f20c4cf3fc8be8c92c4b45c8ab80a7fb3b58f6f81f06c4c559b85de4f5865178eee730de46eeb72b63789e19310af04
-
SSDEEP
3072:dtDulZKksGzZjDDeqCe5ToU21kkH2ip0KuPk2afiMpltkrkbtNLWGtVeHnx:d6KksSrIU2ykH2ipsPnafFlerkb3Lrta
Malware Config
Targets
-
-
Target
fc12d5b309f5090cc04ae5a8aea31c5a_JaffaCakes118
-
Size
173KB
-
MD5
fc12d5b309f5090cc04ae5a8aea31c5a
-
SHA1
0fa6b9ab2032dc01e5a2881b8610af5dd08bec46
-
SHA256
123f5a6eb28a7e7936a67234374dbc4519cb1f96b1378af2883a51d6e605fb85
-
SHA512
3238cbe92132472138d4f432044bfb077f20c4cf3fc8be8c92c4b45c8ab80a7fb3b58f6f81f06c4c559b85de4f5865178eee730de46eeb72b63789e19310af04
-
SSDEEP
3072:dtDulZKksGzZjDDeqCe5ToU21kkH2ip0KuPk2afiMpltkrkbtNLWGtVeHnx:d6KksSrIU2ykH2ipsPnafFlerkb3Lrta
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence
-
Modiloader family
-
ModiLoader Second Stage
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1