Extracted

• • Target

    60470b12eeb6ef9792328a120ca0ab29_JaffaCakes118

  • Size

    310KB

  • MD5

    60470b12eeb6ef9792328a120ca0ab29

  • SHA1

    2d5b99a7dca733111ca1046de99c8ba53ab3a310

  • SHA256

    6d1dabc2ae2d678358c28f110a3cecc11333a5b464781432b83f482bfe64b2c0

  • SHA512

    bf190aef62bcf8630b43ddbc1e6624429ba8c0ae56c8544d69cb13d1d202e0cb0221ec8601359d447d2cd93169bb5b44c25fa88eb7b0374ae70cc71efd0095d9

  • SSDEEP

    6144:AYG377xS2Vp2CeiorXhwTBN53CpcCJJvHENoS:cr7xS2Vp6FwTAbJJvHuoS

  Score

  10^/10

  latentbotmodiloaderevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • UAC bypass

    evasiontrojan

  • ModiLoader Second Stage

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2