Extracted

• • Target

    JaffaCakes118_52b522986029ce23f0b2c2326792cafb

  • Size

    441KB

  • MD5

    52b522986029ce23f0b2c2326792cafb

  • SHA1

    467db5e1435432eb2658c991312db0e65e597ceb

  • SHA256

    226938f7d629994198fb18b5613046111040fffae659ccd9bb7da5ee8aa49d5d

  • SHA512

    94a9044ad68f1d3c6b3da7a3f3b927b982382a859c053dafb72438be9cc8be19596f9dcf7a287a3d715e04acc94d6ac8cac93fc35a810d1e365c33f078b61e81

  • SSDEEP

    12288:1+BcK/lGRgOUqmq9kR6lhKXcWV02ZgeSgl9uDPX:kBcK/cRgOnmq9g6cV02bSqo7

  Score

  10^/10

  latentbotmodiloaderdiscoveryevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modiloader family

    modiloader

  • UAC bypass

    evasiontrojan

  • ModiLoader Second Stage

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2