Extracted

• • Target

    f43933b50fd0bfc96da5a0e2e4a12973_JaffaCakes118

  • Size

    771KB

  • MD5

    f43933b50fd0bfc96da5a0e2e4a12973

  • SHA1

    6d3b255a352901a2bd5bc24a015e6a07b50e4d3b

  • SHA256

    f5f424d1dd1dbb7ad82b9f202b5a3d526635d5428add023c6a72d720e96000ce

  • SHA512

    9c6236e7d407713777621afad96b1ad0ab50d9a1eba3573c3e22de7a20ed271f045122f23562436eb8a618fc6869591f7e515b7d1ce3959b62f4c4bee8aeda12

  • SSDEEP

    24576:wEvm150IWxOjgE5XiaMturF8EamIo2f0wm+EfU4n:wEy5t5XCwhzI70wL6U4n

  Score

  10^/10

  latentbotmodiloaderdiscoveryevasionpersistencethemidatrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modiloader family

    modiloader

  • UAC bypass

    evasiontrojan

  • ModiLoader Second Stage

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2