Overview

overview

10

Static

static

10

16986b5286...18.exe

windows7-x64

10

16986b5286...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16986b5286858e49fa000a103c0d9405_JaffaCakes118

  • Size

    294KB

  • Sample

    240627-ta7eka1brj

  • MD5

    16986b5286858e49fa000a103c0d9405

  • SHA1

    72c953a56f9267a033f02c933c8b58998e3373d5

  • SHA256

    955620a30a2a2c520103f303fd2f3e8bc8c2ef12c0e5ee738243bc0c507efe90

  • SHA512

    852dc312952fe1d9fced673d6d991baed28d10afb0699785e0067dcd94fec10515652289049110b2bd2260c15c80bc731f2a81a16ef5627d6fc31018502e09f3

  • SSDEEP

    6144:AVdYTgSfBuJAvrndiEdsgVwu/vUkvfnXzSEhvHXMjg:W5JAvrnvvz3EM

Score
10/10
modiloaderpersistencetrojan

Malware Config

Targets

    • Target

      16986b5286858e49fa000a103c0d9405_JaffaCakes118

    • Size

      294KB

    • MD5

      16986b5286858e49fa000a103c0d9405

    • SHA1

      72c953a56f9267a033f02c933c8b58998e3373d5

    • SHA256

      955620a30a2a2c520103f303fd2f3e8bc8c2ef12c0e5ee738243bc0c507efe90

    • SHA512

      852dc312952fe1d9fced673d6d991baed28d10afb0699785e0067dcd94fec10515652289049110b2bd2260c15c80bc731f2a81a16ef5627d6fc31018502e09f3

    • SSDEEP

      6144:AVdYTgSfBuJAvrndiEdsgVwu/vUkvfnXzSEhvHXMjg:W5JAvrnvvz3EM

    Score
    10/10
    modiloaderpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Server Software Component

1
T1505

Terminal Services DLL

1
T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks