General

  • Target

    JaffaCakes118_1bf3e896811760baa0f9e349d36d0b4b

  • Size

    518KB

  • Sample

    250123-3b4vhazmhq

  • MD5

    1bf3e896811760baa0f9e349d36d0b4b

  • SHA1

    247495d38ff5ff2cdfe88dafe518adea573e5bb6

  • SHA256

    c1bab28d42cdaa6e79af5877fe56d191a3a20ff020abcf49539ba33336ce44c4

  • SHA512

    e1c92d355a16fd1b1e38fdfa8a524fe30b4f55c5af3fad51782fda56c5510d01d1c87adc11749c18d1a704586bd1ce2e41cde42425e34eba0f25da7080fd684f

  • SSDEEP

    12288:3eFzFqoS/Kr7fw2zuR71GUItA/1QFslfeqAz:3O5r7a7kUICGilfeqQ

Malware Config

Targets

    • Target

      JaffaCakes118_1bf3e896811760baa0f9e349d36d0b4b

    • Size

      518KB

    • MD5

      1bf3e896811760baa0f9e349d36d0b4b

    • SHA1

      247495d38ff5ff2cdfe88dafe518adea573e5bb6

    • SHA256

      c1bab28d42cdaa6e79af5877fe56d191a3a20ff020abcf49539ba33336ce44c4

    • SHA512

      e1c92d355a16fd1b1e38fdfa8a524fe30b4f55c5af3fad51782fda56c5510d01d1c87adc11749c18d1a704586bd1ce2e41cde42425e34eba0f25da7080fd684f

    • SSDEEP

      12288:3eFzFqoS/Kr7fw2zuR71GUItA/1QFslfeqAz:3O5r7a7kUICGilfeqQ

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Modiloader family

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks