Overview

overview

10

Static

static

3

fcdf2f5a69...18.exe

windows7-x64

10

fcdf2f5a69...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fcdf2f5a69e7e27cdc780c09c486d3fe_JaffaCakes118

  • Size

    674KB

  • Sample

    241218-yfrnhszphn

  • MD5

    fcdf2f5a69e7e27cdc780c09c486d3fe

  • SHA1

    7ba542aecf46dd90a393b9bcad4ba2a14e70b49c

  • SHA256

    de0b048c4e3e2ac7233819ae2b264aee7fc0c48d65c3a1af3e0744d66d396a7e

  • SHA512

    3c76c8fe3af54957d3781aa56a7d2ff05aab2836606c370ca9552b90afafcf99dcdfd637381128ab0fb67b1e699e91f5f7ee146c0f2e765e35a8f5bf94c2a57b

  • SSDEEP

    12288:/m6OWzr++VlFGWQTPW2wMrQ6/2gmRHECF3Z4mxxIoEtlK+kt9T2MM:5OW1VlFCzW2wUQ1gQQmXBG1

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      fcdf2f5a69e7e27cdc780c09c486d3fe_JaffaCakes118

    • Size

      674KB

    • MD5

      fcdf2f5a69e7e27cdc780c09c486d3fe

    • SHA1

      7ba542aecf46dd90a393b9bcad4ba2a14e70b49c

    • SHA256

      de0b048c4e3e2ac7233819ae2b264aee7fc0c48d65c3a1af3e0744d66d396a7e

    • SHA512

      3c76c8fe3af54957d3781aa56a7d2ff05aab2836606c370ca9552b90afafcf99dcdfd637381128ab0fb67b1e699e91f5f7ee146c0f2e765e35a8f5bf94c2a57b

    • SSDEEP

      12288:/m6OWzr++VlFGWQTPW2wMrQ6/2gmRHECF3Z4mxxIoEtlK+kt9T2MM:5OW1VlFCzW2wUQ1gQQmXBG1

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks