Overview

overview

10

Static

static

3

JaffaCakes...9e.exe

windows7-x64

10

JaffaCakes...9e.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_0a81bbc1b83330d03d760374094a599e

  • Size

    1.8MB

  • Sample

    250122-fg4qcszmep

  • MD5

    0a81bbc1b83330d03d760374094a599e

  • SHA1

    47747c41fee807b80a437166cf9323c517d0cafd

  • SHA256

    da2ba3a6cd9a50e7461aa622fb92d0a5623e6d1a8be3e5d16aed1eabcb3e3d24

  • SHA512

    d2cfcc57e18936a0ee95dd68bd64b97621c49d6a46507ab77a4eff387b8dffb0b8acacd8754fbcbb486e20fbe09265ba7776b920c755fb47df464213e0702bdc

  • SSDEEP

    49152:sY4p8Pt10/v65JrFXFarp9M0EnUH0/PdyGy8kRALLcduYZ:sY4p8FaH65Jf4aUU/PHy8kRiAdT

Score
10/10
modiloaderdefense_evasiondiscoverypersistencethemidatrojan

Malware Config

Targets

    • Target

      JaffaCakes118_0a81bbc1b83330d03d760374094a599e

    • Size

      1.8MB

    • MD5

      0a81bbc1b83330d03d760374094a599e

    • SHA1

      47747c41fee807b80a437166cf9323c517d0cafd

    • SHA256

      da2ba3a6cd9a50e7461aa622fb92d0a5623e6d1a8be3e5d16aed1eabcb3e3d24

    • SHA512

      d2cfcc57e18936a0ee95dd68bd64b97621c49d6a46507ab77a4eff387b8dffb0b8acacd8754fbcbb486e20fbe09265ba7776b920c755fb47df464213e0702bdc

    • SSDEEP

      49152:sY4p8Pt10/v65JrFXFarp9M0EnUH0/PdyGy8kRALLcduYZ:sY4p8FaH65Jf4aUU/PHy8kRiAdT

    Score
    10/10
    modiloaderdefense_evasiondiscoverypersistencethemidatrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks