Overview

overview

10

Static

static

3

JaffaCakes...f2.exe

windows7-x64

7

JaffaCakes...f2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_0ee4b65c6ed404f38c1778c2ecd5e3f2

  • Size

    482KB

  • Sample

    250122-spx9rssle1

  • MD5

    0ee4b65c6ed404f38c1778c2ecd5e3f2

  • SHA1

    960040e8e85087c7a63f157a812c14e644d940eb

  • SHA256

    791a9f7132a2b78a3560d5f48779d64805c2dcd8e2ed9835656cffefca3a341a

  • SHA512

    705bc60775e3cec60dd0f4ec2f144fc57a24de9987a2c63e8e29442ac7974d3b4f1d5544105c14b561135426a70616a50b01fd049ab4ecf925f7c88da6e4dd3e

  • SSDEEP

    12288:CqzglbmNf2Yhr1F3Z4mxxx8E7PIxyJ00riPeZdRTR:vsl+f5r1QmXx8E7wxny

Score
10/10
modiloaderdefense_evasiondiscoverytrojanupx

Malware Config

Targets

    • Target

      JaffaCakes118_0ee4b65c6ed404f38c1778c2ecd5e3f2

    • Size

      482KB

    • MD5

      0ee4b65c6ed404f38c1778c2ecd5e3f2

    • SHA1

      960040e8e85087c7a63f157a812c14e644d940eb

    • SHA256

      791a9f7132a2b78a3560d5f48779d64805c2dcd8e2ed9835656cffefca3a341a

    • SHA512

      705bc60775e3cec60dd0f4ec2f144fc57a24de9987a2c63e8e29442ac7974d3b4f1d5544105c14b561135426a70616a50b01fd049ab4ecf925f7c88da6e4dd3e

    • SSDEEP

      12288:CqzglbmNf2Yhr1F3Z4mxxx8E7PIxyJ00riPeZdRTR:vsl+f5r1QmXx8E7wxny

    Score
    10/10
    defense_evasiondiscoveryupxmodiloadertrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks