Overview

overview

10

Static

static

3

JaffaCakes...90.exe

windows7-x64

10

JaffaCakes...90.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_65dc481fcee16e780e8fb56693642e90

  • Size

    288KB

  • Sample

    250102-r5graaykeq

  • MD5

    65dc481fcee16e780e8fb56693642e90

  • SHA1

    cf30e03cc5a1406af29ef873c2f81ba0ac737f22

  • SHA256

    17cccd64cc6371d3193be2bdcacceb26e665b562502eb5032d77c7c250f2280d

  • SHA512

    4de8faeaab4bfbbae55dbb8f5b948728103b3feece145bae628ea49f81be2f02adef9b7f4d4b13f2693d002052aa9461eab7aea296ebec9198e14be7f4d299ae

  • SSDEEP

    6144:t3jJl1OFw6XQu17wo1z0P+KQk0RqM4frxa/YQs:t3jJl1OFw6AY7wS0Vh0SNaQ

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      JaffaCakes118_65dc481fcee16e780e8fb56693642e90

    • Size

      288KB

    • MD5

      65dc481fcee16e780e8fb56693642e90

    • SHA1

      cf30e03cc5a1406af29ef873c2f81ba0ac737f22

    • SHA256

      17cccd64cc6371d3193be2bdcacceb26e665b562502eb5032d77c7c250f2280d

    • SHA512

      4de8faeaab4bfbbae55dbb8f5b948728103b3feece145bae628ea49f81be2f02adef9b7f4d4b13f2693d002052aa9461eab7aea296ebec9198e14be7f4d299ae

    • SSDEEP

      6144:t3jJl1OFw6XQu17wo1z0P+KQk0RqM4frxa/YQs:t3jJl1OFw6AY7wS0Vh0SNaQ

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

      evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • ModiLoader Second Stage

    • Adds policy Run key to start application

      persistence

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks