Extracted

• • Target

    f3e9cbc604cfc56d378aed288730a01d_JaffaCakes118

  • Size

    190KB

  • MD5

    f3e9cbc604cfc56d378aed288730a01d

  • SHA1

    84ed0621b0c1b29e951f0fcfaa13b50aa949edfb

  • SHA256

    9698257a594c71c1595e62907bb164d407cc61acead6745d7d431be36884df9f

  • SHA512

    c9a66b6691fe4c3595df31611c759a5afc71dc1640062a5fa309fb901b2b7f20d23e0d29b8dad66cee91d33f60357a557c362c0061290bba1b10f8140bb500b2

  • SSDEEP

    3072:ykT5Bh4vGbkqYb17WpK7zFf2ef53q0xb4zquORfKQPzE9mHst2:ltIKYb17ztE0KOfKQCmHst

  Score

  10^/10

  modiloadercollectiondiscoverytrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • ModiLoader Second Stage

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2