Extracted

• • Target

    224054c64536599cfd84b01b8da90e70_JaffaCakes118

  • Size

    2.4MB

  • MD5

    224054c64536599cfd84b01b8da90e70

  • SHA1

    5568181e8a6459fadf6657d6fc9198e0ef82269c

  • SHA256

    5c7eebdc6047898af1da70d12326153541d84ebb4b15e9f75d4fb2cd70a30a9f

  • SHA512

    bdf80d39a2fa3c65b2f48707b35c87f84badfda2b440abfa1d9ed6c74159d5e633e0861eb4907884b71b0878b67e30c1e16c22c35e65b4a5ba343950ce7891cb

  • SSDEEP

    49152:R/HkINdk626jhO50dEiRnXv8b/vXM2Ldll9nV8VJUtGCZzHZOjO:R/HDkd6k0dlRf8b/vc2LLl9eVIGYDZOi

  Score

  10^/10

  modiloaderevasionpersistencespywarestealertrojanupx

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • UAC bypass

    evasiontrojan

  • ModiLoader Second Stage

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2