Extracted

• • Target

    baa2c795c2072c9b1b8c7a96c98c62d3_JaffaCakes118

  • Size

    200KB

  • MD5

    baa2c795c2072c9b1b8c7a96c98c62d3

  • SHA1

    641df1acbf84c469f3303178725609af2dff3bfb

  • SHA256

    ed82187baa1260c87264ebdaaa6f32eb7494921079e134eb62b98ea80ab5e51b

  • SHA512

    b00eaac49685c3f1a83b868d3a9ac45d0a5115394c1f963a4b17eb888cf2e74891d5891b4b7883e68745d2b1768733e456ce9994ada5bea880651fbeb26d9d3d

  • SSDEEP

    3072:hzQxqdO8nnaXcEEGZJGO2KiCGFaJty7bEO+064P319opUEQrc59fYzbYgX59gYF2:2sdpnnucEHc31jEQuQzbHX52Y

  Score

  10^/10

  modiloaderdiscoverytrojanupxsalitybackdoorevasionpersistenceprivilege_escalation

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modiloader family

    modiloader

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • ModiLoader Second Stage

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2