Extracted

• • Target

    free_skins.exe

  • Size

    133KB

  • MD5

    9b348250e32f3b0cf5d738b2c108c46e

  • SHA1

    604bb6adde8cc83d12a06b75b9b0ad93ad4ca5b6

  • SHA256

    d3f10e3b0e3971ebedbecdeb79116e4f8b81c6221a6aa5d150241d999e2b1de5

  • SHA512

    0f5dcc373365bcd6ee9272419139725e6ab24b504337dbd95c9b5029694733a4595c62a3778d1a1d496bca8d5032a8a3e9d7efb66e6a9ebde40f4439e8b9ecdf

  • SSDEEP

    3072:+1+MJKrUnFYY5z1i0Nmbi5fJBNolVQy5XoZNM++doutDW9r:GIrPj0NmWtNOJ5XdoSK9r

  Score

  10^/10

  latentbotmodiloaderdiscoveryevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • UAC bypass

    evasiontrojan

  • ModiLoader Second Stage

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2