Overview

overview

10

Static

static

1

51badea0de...27.exe

windows7-x64

10

51badea0de...27.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_e0151f1635de9481aab891086fd12615effc288ecba9412fbb425eda47cd58d9

  • Size

    645KB

  • Sample

    241226-3qbghavpay

  • MD5

    2c079ec3527c8a31dded958a88c917f5

  • SHA1

    ce32e5236551c1f28fbf2fbeda0dd82383c87733

  • SHA256

    e0151f1635de9481aab891086fd12615effc288ecba9412fbb425eda47cd58d9

  • SHA512

    1df0983660b4f53074ab293ef72fd9048b2e1ce2ebceb357782c2085f3115935ec78faca44d5f81d9ab8d015650b2a8056365c7c24464f67362cd033c0fe6533

  • SSDEEP

    12288:Wg2HLmPKKsq/EvmKiYXg56dXL3IhsQaWDYvpP2d1m0+OUzVaZM:WgWjnQ5GrI6DvV2dFRCkM

Score
10/10
modiloaderbootkitdiscoveryexecutionpersistencetrojan

Malware Config

Targets

    • Target

      51badea0de1062d6e7c1040fed6cac7e39d37c983759bdb6332e231c73512b27

    • Size

      974KB

    • MD5

      2d1d270ec13d70d6acfd275865bb5752

    • SHA1

      d6b9dc21092e98ad34ae3a73781e6c3497aee75f

    • SHA256

      51badea0de1062d6e7c1040fed6cac7e39d37c983759bdb6332e231c73512b27

    • SHA512

      12f0eba7c82352f200852cf408b230249a5d570801bab715bea849ff1d9263985a458bd8965f7bd90c33adedaf01f18cb3da623fdf1839dd65dfd40b7fa16912

    • SSDEEP

      12288:11OK3Y7kNC+VSojsv4Rwe+b1MQOhj7hHiT1/iQl0SRp5HfgB/iRxtPa3iI2:11t3BNC2Djsv4Cih0luSxHY/i9iyI2

    Score
    10/10
    modiloaderbootkitdiscoveryexecutionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader First Stage

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks