Overview

overview

10

Static

static

3

JaffaCakes...9a.exe

windows7-x64

10

JaffaCakes...9a.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_059620eed11fb810cbe338e3adfcd19a

  • Size

    427KB

  • Sample

    250121-syf2vazrcw

  • MD5

    059620eed11fb810cbe338e3adfcd19a

  • SHA1

    2dea7047c0213a8695665c2f01a14bc1457b70ec

  • SHA256

    e239def3faaa37f347965c7a0f471fb937d11ea7cb65a63f6ffe587ebef28012

  • SHA512

    70196dfe141a760a6d43cccef90df8203c19793a9f1456aad71f98608de83d13b5c1af5f8362b4dca2ef2f2ed996c8fe86322d0e1ffbf88948671ca32f0e3d3f

  • SSDEEP

    12288:GSCC/p+/vzIhELBiJygmQhdyb1lUu3SLBN1:c8+/eEgQ6hE28S1N1

Score
10/10
modiloaderdefense_evasiondiscoverytrojan

Malware Config

Targets

    • Target

      JaffaCakes118_059620eed11fb810cbe338e3adfcd19a

    • Size

      427KB

    • MD5

      059620eed11fb810cbe338e3adfcd19a

    • SHA1

      2dea7047c0213a8695665c2f01a14bc1457b70ec

    • SHA256

      e239def3faaa37f347965c7a0f471fb937d11ea7cb65a63f6ffe587ebef28012

    • SHA512

      70196dfe141a760a6d43cccef90df8203c19793a9f1456aad71f98608de83d13b5c1af5f8362b4dca2ef2f2ed996c8fe86322d0e1ffbf88948671ca32f0e3d3f

    • SSDEEP

      12288:GSCC/p+/vzIhELBiJygmQhdyb1lUu3SLBN1:c8+/eEgQ6hE28S1N1

    Score
    10/10
    modiloaderdefense_evasiondiscoverytrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks