Overview

overview

10

Static

static

3

JaffaCakes...2c.exe

windows7-x64

10

JaffaCakes...2c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_0c10419d0b6e63120b280eeffe4ee42c

  • Size

    618KB

  • Sample

    250122-knnd6sxqev

  • MD5

    0c10419d0b6e63120b280eeffe4ee42c

  • SHA1

    39d02fb90f08b647efefc682e353d0a44271fe89

  • SHA256

    fc3759a4688531b6f0dee2720c75d047ffe871d8bf673be266b13a2f453c9105

  • SHA512

    93f156514f068f2a445542614f8db5c5aa4c3c2d89e826cc6166244ceea0a3b145ee41f60b0f568ae1782f823c2142d294d6da1f95be1cac425cadc37d6687c5

  • SSDEEP

    12288:NnEXp6gxVV/WDpD0Ws997X5uQmvESXhYyI/lf1c2obY7Gr3IIZD:N8d/WdD0YQm9hYyIZocqr35ZD

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      JaffaCakes118_0c10419d0b6e63120b280eeffe4ee42c

    • Size

      618KB

    • MD5

      0c10419d0b6e63120b280eeffe4ee42c

    • SHA1

      39d02fb90f08b647efefc682e353d0a44271fe89

    • SHA256

      fc3759a4688531b6f0dee2720c75d047ffe871d8bf673be266b13a2f453c9105

    • SHA512

      93f156514f068f2a445542614f8db5c5aa4c3c2d89e826cc6166244ceea0a3b145ee41f60b0f568ae1782f823c2142d294d6da1f95be1cac425cadc37d6687c5

    • SSDEEP

      12288:NnEXp6gxVV/WDpD0Ws997X5uQmvESXhYyI/lf1c2obY7Gr3IIZD:N8d/WdD0YQm9hYyIZocqr35ZD

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks