Extracted

• • Target

    fb2182ed8a5299b8023e9d64383c7795_JaffaCakes118

  • Size

    223KB

  • MD5

    fb2182ed8a5299b8023e9d64383c7795

  • SHA1

    0a0c38bb3c6cfed6d75446ad409f866356114962

  • SHA256

    50e6053b994b6358c5fcc3ba4ec431458a4875e7629af24e8b9c84ab5825ef84

  • SHA512

    80c313ec80b097e0b3aed2b16800afbaa35323cfd592ea02d389b5843f8dc01dd7fcfd4b33a305decd87b2b3eb5312988b53a74d2709f20eb2cd214db55011bf

  • SSDEEP

    3072:bXuW/8LACBJR/jCt/K5VlnHGwKTiSWhYZESSS1wbIV7pWIxqcKO7cLfAzqbwpVjD:bebAeX4/K5RthYZl1Omdqc3QLadbfoS1

  Score

  10^/10

  modiloaderdiscoverypersistencetrojanupx

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modiloader family

    modiloader

  • ModiLoader Second Stage

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2