General
-
Target
JaffaCakes118_d098398c7b892d854e0876ae59a0418e
-
Size
240KB
-
Sample
250423-ck9h8sxpw3
-
MD5
d098398c7b892d854e0876ae59a0418e
-
SHA1
adeac0bf525f4cb881ddc9c7f2e5ecbc28e4d56a
-
SHA256
15a82a3a9366e6fd52892516bb7e17d68441d19017d21da23f44dce66bbdd7d9
-
SHA512
a2ec9853970c0d9d2539c5d3ddc53d617c46b4a5de960abd4d8646fbf759a54abe05891d005f13b54289136eacd051668fed3cd5233cafd122fa644800822dce
-
SSDEEP
3072:J/vJHq08TARKeM6Xt9PFC685Th3ppvFTRphfUXcrOLj1H6gPWTzmfE9GdEhSvQEC:NvADARrMUFn8zjFf2XcKLR6gizUzdEhT
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_d098398c7b892d854e0876ae59a0418e.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral2
Sample
JaffaCakes118_d098398c7b892d854e0876ae59a0418e.exe
Resource
win11-20250410-en
Malware Config
Extracted
latentbot
thequestion.zapto.org
Targets
-
-
Target
JaffaCakes118_d098398c7b892d854e0876ae59a0418e
-
Size
240KB
-
MD5
d098398c7b892d854e0876ae59a0418e
-
SHA1
adeac0bf525f4cb881ddc9c7f2e5ecbc28e4d56a
-
SHA256
15a82a3a9366e6fd52892516bb7e17d68441d19017d21da23f44dce66bbdd7d9
-
SHA512
a2ec9853970c0d9d2539c5d3ddc53d617c46b4a5de960abd4d8646fbf759a54abe05891d005f13b54289136eacd051668fed3cd5233cafd122fa644800822dce
-
SSDEEP
3072:J/vJHq08TARKeM6Xt9PFC685Th3ppvFTRphfUXcrOLj1H6gPWTzmfE9GdEhSvQEC:NvADARrMUFn8zjFf2XcKLR6gizUzdEhT
-
Latentbot family
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3