Overview

overview

10

Static

static

3

JaffaCakes...1f.exe

windows7-x64

10

JaffaCakes...1f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_c650d943b26950830ff91945dadafa1f

  • Size

    244KB

  • Sample

    250119-ngqgqswjhk

  • MD5

    c650d943b26950830ff91945dadafa1f

  • SHA1

    3e8065836d7018e684969946afb03573a7beb688

  • SHA256

    2beb5d46c94486a211643653d65d1a1952b3ef0983e74d1e4bf4476fa90833ce

  • SHA512

    f9c125dbb56d6c9e0644541f471da8b6aab58de9753b7994610235a2f6afcf7b7a608efc0fbda402e7be757dc0caa70fba20090170829164f6fa6df8384aa2fc

  • SSDEEP

    6144:AaAbo5uA86xeI/s5tD4mMVohX7cla9PUCrzXF:AfbIkXIlaTrz1

Score
10/10
modiloaderbootkitdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      JaffaCakes118_c650d943b26950830ff91945dadafa1f

    • Size

      244KB

    • MD5

      c650d943b26950830ff91945dadafa1f

    • SHA1

      3e8065836d7018e684969946afb03573a7beb688

    • SHA256

      2beb5d46c94486a211643653d65d1a1952b3ef0983e74d1e4bf4476fa90833ce

    • SHA512

      f9c125dbb56d6c9e0644541f471da8b6aab58de9753b7994610235a2f6afcf7b7a608efc0fbda402e7be757dc0caa70fba20090170829164f6fa6df8384aa2fc

    • SSDEEP

      6144:AaAbo5uA86xeI/s5tD4mMVohX7cla9PUCrzXF:AfbIkXIlaTrz1

    Score
    10/10
    modiloaderbootkitdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks