Overview

overview

10

Static

static

3

JaffaCakes...5f.exe

windows7-x64

10

JaffaCakes...5f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_023a0256b1cbc2ec41c7b6e1193ad65f

  • Size

    554KB

  • Sample

    250121-fvb79sxqeq

  • MD5

    023a0256b1cbc2ec41c7b6e1193ad65f

  • SHA1

    43dc185bb5fc8e4afaf6b859f9013cc8ab57ca5a

  • SHA256

    ad0313e5c846916859f4b2166f89c87290d41b7d04a5352d38fb700d98297cb6

  • SHA512

    2a397659debc5b2f46fa1dfe221483fcc63429f99c2fb56827209dd2d0ab401da35d219108f7b0686226c887c12e8a51b2f5640742332ad4c8ef97d1da6e5cec

  • SSDEEP

    6144:xOr2DKVquhuUpmpc+bBXW0Gpr2DKVquhuUpmpc+bBXW0Gpr2DKVquhuUpmpc+bBF:xgEK8hc+NGPEK8hc+NGPEK8hc+NGW

Score
10/10
modiloaderdefense_evasiondiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      JaffaCakes118_023a0256b1cbc2ec41c7b6e1193ad65f

    • Size

      554KB

    • MD5

      023a0256b1cbc2ec41c7b6e1193ad65f

    • SHA1

      43dc185bb5fc8e4afaf6b859f9013cc8ab57ca5a

    • SHA256

      ad0313e5c846916859f4b2166f89c87290d41b7d04a5352d38fb700d98297cb6

    • SHA512

      2a397659debc5b2f46fa1dfe221483fcc63429f99c2fb56827209dd2d0ab401da35d219108f7b0686226c887c12e8a51b2f5640742332ad4c8ef97d1da6e5cec

    • SSDEEP

      6144:xOr2DKVquhuUpmpc+bBXW0Gpr2DKVquhuUpmpc+bBXW0Gpr2DKVquhuUpmpc+bBF:xgEK8hc+NGPEK8hc+NGPEK8hc+NGW

    Score
    10/10
    modiloaderdefense_evasiondiscoverypersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      defense_evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks