Extracted

• • Target

    20180a09bd56f0614df702155b59eb22_JaffaCakes118

  • Size

    670KB

  • MD5

    20180a09bd56f0614df702155b59eb22

  • SHA1

    a965cd7150fb405653d59994344b4941c8fdf6be

  • SHA256

    55b4dfd9f6a64f7a2b86033f0808e1850cebb5819e476e9dcd25d59bf09366c1

  • SHA512

    c88387b6b9490cb13de28e04bbdabde9437c8ad27fb8c9ee5110ffe12180821bb5a0f4621fb80611e7bbc5b274124e2c94154ef570b8eaa48abf4e066acb87fb

  • SSDEEP

    6144:F2n5g3PZMegQUFyGy+3Lg57V1OnheX88VVcPnxSXeqpZE4GRfKx/8GcsMBvMCmJO:F252EQUFuCgJ/s2q5Gep4E+esTCmfU

  Score

  10^/10

  modiloadernetwirebootkitbotnetdiscoverypersistenceratstealertrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • ModiLoader Second Stage

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2