Extracted

• • Target

    b59361e332e4225f6e6b2689c1187a72_JaffaCakes118

  • Size

    888KB

  • MD5

    b59361e332e4225f6e6b2689c1187a72

  • SHA1

    97971b0503c202a2c4ee1c88dcf85c2bf08fa6f6

  • SHA256

    e8e36723daa8aaeaef03605d1e169e84032c320c67cb2c71177a26dc00d9a281

  • SHA512

    eaef4ced18fd72b770d86916af4a7cfdce73e50aa4a6a53c208256593da28713f52428aad4a73d2627497f4f4d7ea486beaa68ec1fa134cfe9bc32a864c98f3a

  • SSDEEP

    12288:LhhSJRyeHyKAhIV4LoJze68PvanRJkHVphYJGTaTFxfj5ItEByClkRqTHsoo4zkF:LqyeHypU4EJK007QGTojfjqIkF

  Score

  10^/10

  modiloaderxtremeratdefense_evasiondiscoveryevasionpersistenceratspywaretrojanupx

  • Detect XtremeRAT payload

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modiloader family

    modiloader

  • UAC bypass

    evasiontrojan

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • ModiLoader Second Stage

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2