Overview

overview

10

Static

static

10

JaffaCakes...37.exe

windows7-x64

10

JaffaCakes...37.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_7ac6bdd5ec0e0feaf494500fbc179b37

  • Size

    270KB

  • Sample

    250104-ve8c4azpgj

  • MD5

    7ac6bdd5ec0e0feaf494500fbc179b37

  • SHA1

    03ee410ff15374b0d8194e749a35edc74d2f785a

  • SHA256

    073df7eecb5695802216343c807e82c4874d6c3995653cedf59d94775abf86e8

  • SHA512

    b9024e0cf17be4b912370e8d7cda2372963eebcec1c54c4f8a536eaa028072ba3a60fcb5b15c7ef77e83f6e459c9c31b3237d7a6336049116068b53a84043e20

  • SSDEEP

    6144:ZG377xS2Vp2CeiorXdwTBgWx4v539pcCJJvHw:sr7xS2Vp6RwTyCwbJJvHw

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      JaffaCakes118_7ac6bdd5ec0e0feaf494500fbc179b37

    • Size

      270KB

    • MD5

      7ac6bdd5ec0e0feaf494500fbc179b37

    • SHA1

      03ee410ff15374b0d8194e749a35edc74d2f785a

    • SHA256

      073df7eecb5695802216343c807e82c4874d6c3995653cedf59d94775abf86e8

    • SHA512

      b9024e0cf17be4b912370e8d7cda2372963eebcec1c54c4f8a536eaa028072ba3a60fcb5b15c7ef77e83f6e459c9c31b3237d7a6336049116068b53a84043e20

    • SSDEEP

      6144:ZG377xS2Vp2CeiorXdwTBgWx4v539pcCJJvHw:sr7xS2Vp6RwTyCwbJJvHw

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks