Overview

overview

10

Static

static

1

PO 7512 order,pdf.exe

windows7-x64

10

PO 7512 order,pdf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_667eaa3151fe7a64c9d13c7b972fe8435f6025a5a0de160bb7c82d4335b23e08

  • Size

    331KB

  • Sample

    241225-rl6w3avmby

  • MD5

    0264489cb8e5f2742e6d889694158865

  • SHA1

    f4530e7f7d4e141bc718ccd5c6389406ec2b54e8

  • SHA256

    667eaa3151fe7a64c9d13c7b972fe8435f6025a5a0de160bb7c82d4335b23e08

  • SHA512

    c694ef35f75bf0d65e340f58c8396d7c3a9182d5557875e03a04b457cc3268a55a30b78c8104d71e2d8fdb9fc98c5da0aaf29477d498e81811f937b39016116d

  • SSDEEP

    6144:IAUIrUbI/R5XRxVO3wRI8cL+ZB+Lk4jNDMpu9p3RmAtoyVLIrie:9Uisgy8DR4jou9phmpoMGe

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Extracted

Family

modiloader

C2

https://cdn.discordapp.com/attachments/768001324712591383/771226746216775710/GfedMNJ

Targets

    • Target

      PO 7512 order,pdf.exe

    • Size

      640KB

    • MD5

      dfe89a4e93c96da72a02f96492c8c2e2

    • SHA1

      990070055cf3c7deef1b627469f5493b74a9b0ba

    • SHA256

      a063e1f53bc7f7e9922ff45c6bd2d6431770b134796daf0cc753869648372f08

    • SHA512

      adcf2c90134bc8cacd47218019a1e0e337824ef88800b49ca07d6966eef121386fad572361479e60ce798e85c4be54ee3f53bf0b476118b668ff1be44671352a

    • SSDEEP

      6144:gWlqPBojv06OaAsvSkNfTLsrPEObj0O/lidMnuR8w/ZMgs9Ko2ThrFnmpI+40Jpb:BoPBoYGAsaEYjTXwhhs9e3nmiOrvLKm

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader First Stage

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks