Overview

overview

10

Static

static

3

JaffaCakes...e9.exe

windows7-x64

10

JaffaCakes...e9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_99b275b5cc5a6bb8d492490c6979bae9

  • Size

    719KB

  • Sample

    250117-26hebawkby

  • MD5

    99b275b5cc5a6bb8d492490c6979bae9

  • SHA1

    ab7301c148263996feaeff276bf9825be0d39659

  • SHA256

    aecec29b477c1a6f99aa8c512cc3179ef577ce814f74dc87005407bdd1602601

  • SHA512

    79022795c97a82b5737b63c169d33afeb3abf4b1b674b27a2b8b720468e1e736089987a8b2e6ddf2708a2b67d5ba2e74e10e440d98e8b6fe6422ef82f9b90469

  • SSDEEP

    12288:UJv4sbmf230mGKBE6ONz7oCqqu5FP03W3LzO9cg8SjSIMaolh+mS:U1SlmGd6R3qu5FPAiLzARdSIMaN

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      JaffaCakes118_99b275b5cc5a6bb8d492490c6979bae9

    • Size

      719KB

    • MD5

      99b275b5cc5a6bb8d492490c6979bae9

    • SHA1

      ab7301c148263996feaeff276bf9825be0d39659

    • SHA256

      aecec29b477c1a6f99aa8c512cc3179ef577ce814f74dc87005407bdd1602601

    • SHA512

      79022795c97a82b5737b63c169d33afeb3abf4b1b674b27a2b8b720468e1e736089987a8b2e6ddf2708a2b67d5ba2e74e10e440d98e8b6fe6422ef82f9b90469

    • SSDEEP

      12288:UJv4sbmf230mGKBE6ONz7oCqqu5FP03W3LzO9cg8SjSIMaolh+mS:U1SlmGd6R3qu5FPAiLzARdSIMaN

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks