Overview

overview

10

Static

static

3

JAK Inc Re...oc.scr

windows7-x64

10

JAK Inc Re...oc.scr

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    01012025_1607_JAK Inc Remittance Notice TRD8801992 -Copy-doc.scr.iso

  • Size

    1.5MB

  • Sample

    250101-tkszxs1pgw

  • MD5

    c50e2b37f881e58b621be03d70ec176e

  • SHA1

    7f58c889ab4fa54a90cd3bfde6429dfe65f0c82b

  • SHA256

    3812566d242284699d4d602d56446e3d42656dbf11ed179724ff1cb95f0a9697

  • SHA512

    6f053933032410066f3eee92dc1e6b19123950f3f14e9231eb9547ade4ea3e99a5af721d9503eef088ff76d7868b5fcccb0a6ecf479e78f8060f427876720595

  • SSDEEP

    12288:1THHBp6sm4kri5y5dnjxfJz+V3pr+Tykm9W9LDFo+hjr0ls5PsY9Dv7QC:1ThoLrimdnjxxwZAk65PvHL

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      JAK Inc Remittance Notice TRD8801992 -Copy,doc.scr

    • Size

      987KB

    • MD5

      23b640cc7b2cff45ceef1c718e7095e0

    • SHA1

      dcb684e452d59af4b1bc7b5de4bdccd2b82a967b

    • SHA256

      bfc7a921cd679ab7d693e30c552e352a7c564a75ec7e60b25960c63ae9067938

    • SHA512

      1c77efd15a2b3dc3e74d8c808cbcbb15122699754169616e68ea024845447eacfef18b3358ed4d4ca397239f1ed9c9162cd568766baff5732c83f65f8293740d

    • SSDEEP

      12288:STHHBp6sm4kri5y5dnjxfJz+V3pr+Tykm9W9LDFo+hjr0ls5PsY9Dv7QC:SThoLrimdnjxxwZAk65PvHL

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks