Overview

overview

10

Static

static

3

JaffaCakes...c7.exe

windows7-x64

7

JaffaCakes...c7.exe

windows10-2004-x64

7

$PLUGINSDI...64.dll

windows7-x64

3

$PLUGINSDI...64.dll

windows10-2004-x64

3

$PLUGINSDI...RL.dll

windows7-x64

3

$PLUGINSDI...RL.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...sh.dll

windows7-x64

3

$PLUGINSDI...sh.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

anituner.chm

windows7-x64

1

anituner.chm

windows10-2004-x64

1

anituner.exe

windows7-x64

10

anituner.exe

windows10-2004-x64

10

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_caa17b3515a6a4b1de44af5cf44f5fc7

  • Size

    938KB

  • Sample

    250119-r4dy1aspbp

  • MD5

    caa17b3515a6a4b1de44af5cf44f5fc7

  • SHA1

    ebd349715dd3d4de689b95020cb87b616d4989ee

  • SHA256

    61d3e7a824489b33ea6e60c9138bf4d44128194cbd0dc28fe0adc56ccda78ae3

  • SHA512

    37ef8d73b3075cee6877028f70704cc2f94ea9128014e2dd3b89dac95327ab81f0cef6d5a691e470c9fa97042a97df9bbc8002f003477dd888c3a40b7533b818

  • SSDEEP

    12288:g4Gml4/Qx53SqftyVj/UOHEcki+G5DvL+ZPi37Z+YWtdsJHWFLrTB2x9iIbbKUtX:g4dltYy6FLkxG5DvZrQhzs8T4PJ

Score
10/10
modiloaderdiscoverytrojan

Malware Config

Targets

    • Target

      JaffaCakes118_caa17b3515a6a4b1de44af5cf44f5fc7

    • Size

      938KB

    • MD5

      caa17b3515a6a4b1de44af5cf44f5fc7

    • SHA1

      ebd349715dd3d4de689b95020cb87b616d4989ee

    • SHA256

      61d3e7a824489b33ea6e60c9138bf4d44128194cbd0dc28fe0adc56ccda78ae3

    • SHA512

      37ef8d73b3075cee6877028f70704cc2f94ea9128014e2dd3b89dac95327ab81f0cef6d5a691e470c9fa97042a97df9bbc8002f003477dd888c3a40b7533b818

    • SSDEEP

      12288:g4Gml4/Qx53SqftyVj/UOHEcki+G5DvL+ZPi37Z+YWtdsJHWFLrTB2x9iIbbKUtX:g4dltYy6FLkxG5DvZrQhzs8T4PJ

    Score
    7/10
    discovery

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/Base64.dll

    • Size

      4KB

    • MD5

      f0e3845fefd227d7f1101850410ec849

    • SHA1

      3067203fafd4237be0c186ddab7029dfcbdfb53e

    • SHA256

      7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

    • SHA512

      584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

    • SSDEEP

      48:SxSrr7xd14m4bLKwvnvcfDw1hEiauGkDVK+hIg4qT9/3lt:zr7xd14m4qw/vGwrEickDVthcE/

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/BrandingURL.dll

    • Size

      4KB

    • MD5

      71c46b663baa92ad941388d082af97e7

    • SHA1

      5a9fcce065366a526d75cc5ded9aade7cadd6421

    • SHA256

      bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e

    • SHA512

      5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      0dc0cc7a6d9db685bf05a7e5f3ea4781

    • SHA1

      5d8b6268eeec9d8d904bc9d988a4b588b392213f

    • SHA256

      8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

    • SHA512

      814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

    • SSDEEP

      192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      00a0194c20ee912257df53bfe258ee4a

    • SHA1

      d7b4e319bc5119024690dc8230b9cc919b1b86b2

    • SHA256

      dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    • SHA512

      3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/blowfish.dll

    • Size

      22KB

    • MD5

      5afd4a9b7e69e7c6e312b2ce4040394a

    • SHA1

      fbd07adb3f02f866dc3a327a86b0f319d4a94502

    • SHA256

      053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae

    • SHA512

      f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

    • SSDEEP

      384:yTxz0Cv0hqd+1TjQmd9YWrSUEc//////OD5hF92IJpJgLa0MpoYfAz6S:jCvsqdS3QGBREc//////Q53NgLa1ub

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/inetc.dll

    • Size

      20KB

    • MD5

      50fdadda3e993688401f6f1108fabdb4

    • SHA1

      04a9ae55d0fb726be49809582cea41d75bf22a9a

    • SHA256

      6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

    • SHA512

      e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

    • SSDEEP

      384:jQB2ZUVHUxgoJX0eBA6PcH85db+ya9cC0Ac9khYLMkIX0+G5xgZmT+m//a:j/UFeJ5S6PHLNa9cFam/

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      anituner.chm

    • Size

      213KB

    • MD5

      ab12e5874b35462cede0942522be22e6

    • SHA1

      e4f01fbbfc154ad8a00bbd08d81bd5e19a54e80d

    • SHA256

      8006ed398a69095344fdfce74d90f7c7366916d0305fad09f252bfbf0e4b6055

    • SHA512

      89e134e029e0a5f8bd368efb36a51573f29868608500d41025ec3069934481424a53de8474c513ced438a95a84cbda8cf8afa1069cb9a25a60f2a5f1b142c085

    • SSDEEP

      6144:T4HwQZ+PKGrILE9j/wruN+VnN55hnmJ2Tci/ZknF:MQ+aKGsLGj/ZN+VxhnjHZW

    Score
    1/10
    behavioral15behavioral16

    • Target

      anituner.exe

    • Size

      612KB

    • MD5

      2994750df10b747f75dbbf70676eb37b

    • SHA1

      fc73c5af53f7cd51180174e4ba37e7abd82420c3

    • SHA256

      b6b2dbc30ee0c4d78c79fd50080adc246993671495aaa12b2be97de193fa77c4

    • SHA512

      e3008c67dceba5d065e812f5bd10ae9ac444564b7c9066c7981cae03f4c7cd864454689c466cf77f7531dbe141dda2370b8f32c73f61b1f6bff815f010eea366

    • SSDEEP

      12288:Rsgpg50CHj8UEIuXfpA10D5e5j5vT0moh4W2hiH3ktGcqas8cGwmgfNf4i0a:pD5H5yT0moqW2MdcqalLeN1

    Score
    10/10
    modiloaderdiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader First Stage

    behavioral17behavioral18

    • Target

      uninst.exe

    • Size

      42KB

    • MD5

      fa21c1645b859f87cd1e959f85e6638e

    • SHA1

      b59178cbe1e8fd2ac37198a4a39fed466caae3d8

    • SHA256

      4c3617a752cd2fb6c61be4c0d3356e6f327d3469b36ec61fffcc2f5377d2aa12

    • SHA512

      86647eb6db343129205e1723d32041d669d86805bd4840a6c0b350288010c3dc327b1a4cff12d9c913e255beaf6b9ea947a95b33ad3b371aa63b9938904f9ab3

    • SSDEEP

      768:p1cVhpQI2EQK0iPDh84nScF15GYbWjXO3XJEFltdiOv5foji:XQpQ5EP0ijnRTXJ0IOhoi

    Score
    7/10
    discovery

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral19behavioral20

MITRE ATT&CK Enterprise v15

Tasks