Extracted

• • Target

    5823799ae3bc8ec696a383996a15d4d3_JaffaCakes118

  • Size

    151KB

  • MD5

    5823799ae3bc8ec696a383996a15d4d3

  • SHA1

    d3dec302c6cae5de8ae124de8e234cf0d83b4a61

  • SHA256

    7a4ebbcc2b6081d81324643fc00562d572bcb1422c4a75033447a1dff3d8df13

  • SHA512

    22b4fe97005f83b65a22d1660326e541bb10a5ea01ee378b78c1d88ac4ef26b84852711ec2a1df2c8f20b03a7ff7380215fdd9fa917be43cc662900442398923

  • SSDEEP

    3072:hoy8j7VnNdrPHaSekwi+mWcQXCyhdn8Hout:x8jZ7rvaU3+mWc7ydAoS

  Score

  10^/10

  latentbotmodiloaderevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • UAC bypass

    evasiontrojan

  • ModiLoader Second Stage

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2