Extracted

• • Target

    6d5e9a6e734d0d4173634aa2caa12020_JaffaCakes118

  • Size

    300KB

  • MD5

    6d5e9a6e734d0d4173634aa2caa12020

  • SHA1

    ad647941970cc2bb377b50ee23c1a7d865345516

  • SHA256

    918941acf2e8857e5c08f7adaa3b1c38717a981fc18a7e2c8c61462e143fa3c6

  • SHA512

    d93b92e5b634581c8046d812aea820b43706516ce0ecf80ab852c3fe50084bff1de214f886ca40ca78e211e47d2c3acef2388bc5432686babbe3eaa8c43c2122

  • SSDEEP

    6144:pBDPC+wDMFndvP/9QzLVe4VFxsd8KtnRZ+EC5bIORTWCzv4oP:ppP5dvPi5GZRgZ5rzFP

  Score

  10^/10

  latentbotmodiloaderdiscoveryevasiontrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • UAC bypass

    evasiontrojan

  • ModiLoader Second Stage

  • Loads dropped DLL

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2