Extracted

• • Target

    d1071d9153dff2e004b77736ec20a94c_JaffaCakes118

  • Size

    130KB

  • MD5

    d1071d9153dff2e004b77736ec20a94c

  • SHA1

    3208a9789b641ae316da93b62a7bd46150ed3129

  • SHA256

    e54a0d079e235fe74a4488f9ba5d52876f4e04dbca091fbdadebcf2b6805bd34

  • SHA512

    0c7d0405e2098a737ffe28ce7bc18d7e5929898dc5d3ba75041a5eadba0cbfb1faee4165d5802fce6d3df019b98e04691e0371f93e480764eb4c06190e6b9dc8

  • SSDEEP

    3072:x2URQRhf9jLFh0aLCM1jGThQKbasi74RSkdNTnss6yVa:rRQpjLF/3QjQmSg9hv8

  Score

  10^/10

  latentbotmodiloaderdiscoveryevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modiloader family

    modiloader

  • UAC bypass

    evasiontrojan

  • ModiLoader Second Stage

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2