Overview

overview

10

Static

static

10

JaffaCakes...ce.exe

windows7-x64

10

JaffaCakes...ce.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_68479d5e684c71826ad90c891dc270ce

  • Size

    399KB

  • Sample

    250102-z3m5aaypen

  • MD5

    68479d5e684c71826ad90c891dc270ce

  • SHA1

    7626160e3e6e780986c047aebda7a84651356c84

  • SHA256

    671aa09f71db521549a7ba958b2115bfdb164df1ee9efd2ed1b514de3d6355d4

  • SHA512

    6b180eb51112b2f9beecf455b857493c6443e26298ff38166d5140b526c3a3bfb9779be631e419b24b6b3483340696f5522dec7514c84010533d04e13f969951

  • SSDEEP

    6144:hG377xS2Vp2CeiorXdwTBgWx4YgWmiFzAsc53zpcCJJvHV:0r7xS2Vp6RwTyC6CR6bJJvHV

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      JaffaCakes118_68479d5e684c71826ad90c891dc270ce

    • Size

      399KB

    • MD5

      68479d5e684c71826ad90c891dc270ce

    • SHA1

      7626160e3e6e780986c047aebda7a84651356c84

    • SHA256

      671aa09f71db521549a7ba958b2115bfdb164df1ee9efd2ed1b514de3d6355d4

    • SHA512

      6b180eb51112b2f9beecf455b857493c6443e26298ff38166d5140b526c3a3bfb9779be631e419b24b6b3483340696f5522dec7514c84010533d04e13f969951

    • SSDEEP

      6144:hG377xS2Vp2CeiorXdwTBgWx4YgWmiFzAsc53zpcCJJvHV:0r7xS2Vp6RwTyC6CR6bJJvHV

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks