Overview

overview

10

Static

static

3

JaffaCakes...3c.exe

windows7-x64

10

JaffaCakes...3c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_120e4df0c3b744955148c5cb537ba83c

  • Size

    120KB

  • Sample

    250122-3xccdasphm

  • MD5

    120e4df0c3b744955148c5cb537ba83c

  • SHA1

    fa94e085eb5b429d6ece757b40f2c994f0f27b60

  • SHA256

    386cb73f22d568f84e070eced920637f774c221ee1e03732d35497d0082b5577

  • SHA512

    364dc439213a3ea944f370fbe79f8d523665dd6a3ed9831b71a48564ad3394b6594c0932874ac7bac49dd87031aa170beb419f51d935bdfa8ec56c4be6d93dcd

  • SSDEEP

    3072:Z3quyYSRimKjuonB5+UNaAats0Sk7UdFFO8Q4Aov//T:BbSRO/B5+Yatik7wFOgAov

Score
10/10
modiloaderdefense_evasiondiscoverytrojanupx

Malware Config

Targets

    • Target

      JaffaCakes118_120e4df0c3b744955148c5cb537ba83c

    • Size

      120KB

    • MD5

      120e4df0c3b744955148c5cb537ba83c

    • SHA1

      fa94e085eb5b429d6ece757b40f2c994f0f27b60

    • SHA256

      386cb73f22d568f84e070eced920637f774c221ee1e03732d35497d0082b5577

    • SHA512

      364dc439213a3ea944f370fbe79f8d523665dd6a3ed9831b71a48564ad3394b6594c0932874ac7bac49dd87031aa170beb419f51d935bdfa8ec56c4be6d93dcd

    • SSDEEP

      3072:Z3quyYSRimKjuonB5+UNaAats0Sk7UdFFO8Q4Aov//T:BbSRO/B5+Yatik7wFOgAov

    Score
    10/10
    modiloaderdiscoverytrojanupxdefense_evasion

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks