General
-
Target
164436a2300ad193d2fa35e11ec20520_JaffaCakes118
-
Size
364KB
-
Sample
240627-rc3haaxbkj
-
MD5
164436a2300ad193d2fa35e11ec20520
-
SHA1
d2c783bf21d9d107a9f4379eeecc849c355bd26c
-
SHA256
5accebc771142e5e525d77328dde8fbaba9e3da59eae8e381d998f4ccb025c57
-
SHA512
05c013768370ea6c1a8393464919a87bc181b8e6c36dbeecb5286c4fecf49c1a34de19162a4cf817f9e32300e1a7b808ea499c9683085523ef7bbb47d15482c0
-
SSDEEP
6144:jsXdIn/4ftH77Tnr8ezU/4gs2ir2Vnf+WDvHd+WAfvW4TBSUl5Y6YUGW:jsXdIAlTAKkirqnGWDvHKtgUAps
Static task
static1
Behavioral task
behavioral1
Sample
164436a2300ad193d2fa35e11ec20520_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
164436a2300ad193d2fa35e11ec20520_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
164436a2300ad193d2fa35e11ec20520_JaffaCakes118
-
Size
364KB
-
MD5
164436a2300ad193d2fa35e11ec20520
-
SHA1
d2c783bf21d9d107a9f4379eeecc849c355bd26c
-
SHA256
5accebc771142e5e525d77328dde8fbaba9e3da59eae8e381d998f4ccb025c57
-
SHA512
05c013768370ea6c1a8393464919a87bc181b8e6c36dbeecb5286c4fecf49c1a34de19162a4cf817f9e32300e1a7b808ea499c9683085523ef7bbb47d15482c0
-
SSDEEP
6144:jsXdIn/4ftH77Tnr8ezU/4gs2ir2Vnf+WDvHd+WAfvW4TBSUl5Y6YUGW:jsXdIAlTAKkirqnGWDvHKtgUAps
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1