General
-
Target
JaffaCakes118_08203e58b4e6980e1db132d6481233e5
-
Size
475KB
-
Sample
250523-v3z2maynz6
-
MD5
08203e58b4e6980e1db132d6481233e5
-
SHA1
ac27e4744f7f7fafbb9db41b3f31946f94e966d8
-
SHA256
b0040c834209fd3fb2484195ac260b423e2f2cfb02f967c538c112dc2f0f29ac
-
SHA512
5602aa4a780f2a6fa8c83f5b06b637626ab21a0fb3729171e250bb6aa37e0a047be40f06961e72be8ad21dbf399765a9181472693e25da5a5e68c7d8fd2717ce
-
SSDEEP
12288:hKnUk4255QVOmAW/5QAPGfp2kE4xYJaJae:IUSQVOmAW/myG7DxYJe
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_08203e58b4e6980e1db132d6481233e5.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
JaffaCakes118_08203e58b4e6980e1db132d6481233e5.exe
Resource
win11-20250502-en
Malware Config
Extracted
latentbot
hackerbatudator.zapto.org
Targets
-
-
Target
JaffaCakes118_08203e58b4e6980e1db132d6481233e5
-
Size
475KB
-
MD5
08203e58b4e6980e1db132d6481233e5
-
SHA1
ac27e4744f7f7fafbb9db41b3f31946f94e966d8
-
SHA256
b0040c834209fd3fb2484195ac260b423e2f2cfb02f967c538c112dc2f0f29ac
-
SHA512
5602aa4a780f2a6fa8c83f5b06b637626ab21a0fb3729171e250bb6aa37e0a047be40f06961e72be8ad21dbf399765a9181472693e25da5a5e68c7d8fd2717ce
-
SSDEEP
12288:hKnUk4255QVOmAW/5QAPGfp2kE4xYJaJae:IUSQVOmAW/myG7DxYJe
-
Latentbot family
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3