Overview

overview

10

Static

static

10

JaffaCakes...b7.exe

windows7-x64

10

JaffaCakes...b7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_633d45d9e7feafe0e2d386ad107ce1b7

  • Size

    346KB

  • Sample

    250102-g94fqsxrdy

  • MD5

    633d45d9e7feafe0e2d386ad107ce1b7

  • SHA1

    9cac047ae71a16df861d066608d5ed5f9091f665

  • SHA256

    40535fea3b91992f55dc5e48750542e6d7e0ac87cfae39fc024e0d8f0abd6b86

  • SHA512

    321041918ced65f5dfee8353d33af3b761359c07aca09b4f35d53a88e10110c1e850756df9326a733b82de2b7be1f44d0790d16c7f291897ce543fe2222ab52c

  • SSDEEP

    6144:HG377xS2Vp2CeiorXdwTBgWx4SFlFAF5382pcCJJvHs:mr7xS2Vp6RwTyChFKbJJvHs

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      JaffaCakes118_633d45d9e7feafe0e2d386ad107ce1b7

    • Size

      346KB

    • MD5

      633d45d9e7feafe0e2d386ad107ce1b7

    • SHA1

      9cac047ae71a16df861d066608d5ed5f9091f665

    • SHA256

      40535fea3b91992f55dc5e48750542e6d7e0ac87cfae39fc024e0d8f0abd6b86

    • SHA512

      321041918ced65f5dfee8353d33af3b761359c07aca09b4f35d53a88e10110c1e850756df9326a733b82de2b7be1f44d0790d16c7f291897ce543fe2222ab52c

    • SSDEEP

      6144:HG377xS2Vp2CeiorXdwTBgWx4SFlFAF5382pcCJJvHs:mr7xS2Vp6RwTyChFKbJJvHs

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks