Overview

overview

10

Static

static

10

JaffaCakes...18.exe

windows7-x64

10

JaffaCakes...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_66ed804f653e9dcf5c836b5ad5c92418

  • Size

    194KB

  • Sample

    250102-v8ww6aspaj

  • MD5

    66ed804f653e9dcf5c836b5ad5c92418

  • SHA1

    6b2fec7d7e895a6773831624a91e90e73c9eca8e

  • SHA256

    8830f0c2976ef2df778b9cf9972c6875729d0122b790ddded86e7e94b717bec9

  • SHA512

    44355fa642ce601c77147f83d33dff8261c3911bc54f39c2986e30ca3b38f279daa1c6c8cf488113384f13bbf5c7ee6193bc3a44f2aeced010cf0d3e64102595

  • SSDEEP

    3072:ONC6BK5CCe6ryo47iq2xe555U7wsiPoHbtTFGO2b2DutFHr534Ipk1lmsfUxoWyy:G7555tPoH5TfwNBF7pK72o/y

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      JaffaCakes118_66ed804f653e9dcf5c836b5ad5c92418

    • Size

      194KB

    • MD5

      66ed804f653e9dcf5c836b5ad5c92418

    • SHA1

      6b2fec7d7e895a6773831624a91e90e73c9eca8e

    • SHA256

      8830f0c2976ef2df778b9cf9972c6875729d0122b790ddded86e7e94b717bec9

    • SHA512

      44355fa642ce601c77147f83d33dff8261c3911bc54f39c2986e30ca3b38f279daa1c6c8cf488113384f13bbf5c7ee6193bc3a44f2aeced010cf0d3e64102595

    • SSDEEP

      3072:ONC6BK5CCe6ryo47iq2xe555U7wsiPoHbtTFGO2b2DutFHr534Ipk1lmsfUxoWyy:G7555tPoH5TfwNBF7pK72o/y

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks