Overview

overview

10

Static

static

3

JaffaCakes...5a.exe

windows7-x64

10

JaffaCakes...5a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_7832f3672e62b214027583fe48aedd5a

  • Size

    349KB

  • Sample

    250104-hbrjysyqck

  • MD5

    7832f3672e62b214027583fe48aedd5a

  • SHA1

    682c06829d87a5ea5492caf2332349cf9365e945

  • SHA256

    4cfe823ccd95562d1de2d3069e1c08148262b5c95a53930d66928819a889d89f

  • SHA512

    dfedd6e0d4601f549846ede3445df0df0d739c0c04efd6529d9f2232c3a9acebe6e0b57c5583ec3df1f1a938fb1aaf640c70ff1ac7b1ec074a51fa16786eeede

  • SSDEEP

    6144:bJqfAIZWrHYb5o3qkmPFph8kwKDt6cMRKmdlK9KB1iLaJtJ1A+ga/dAtYbwjlt0X:beZWHCK3fmdph8kO1RKmMKB1iLotnA+V

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      JaffaCakes118_7832f3672e62b214027583fe48aedd5a

    • Size

      349KB

    • MD5

      7832f3672e62b214027583fe48aedd5a

    • SHA1

      682c06829d87a5ea5492caf2332349cf9365e945

    • SHA256

      4cfe823ccd95562d1de2d3069e1c08148262b5c95a53930d66928819a889d89f

    • SHA512

      dfedd6e0d4601f549846ede3445df0df0d739c0c04efd6529d9f2232c3a9acebe6e0b57c5583ec3df1f1a938fb1aaf640c70ff1ac7b1ec074a51fa16786eeede

    • SSDEEP

      6144:bJqfAIZWrHYb5o3qkmPFph8kwKDt6cMRKmdlK9KB1iLaJtJ1A+ga/dAtYbwjlt0X:beZWHCK3fmdph8kO1RKmMKB1iLotnA+V

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks