Extracted

• • Target

    19c2fbbcdcec7854a366e46d82162c51_JaffaCakes118

  • Size

    600KB

  • MD5

    19c2fbbcdcec7854a366e46d82162c51

  • SHA1

    79e00cec8f02d8970e1427fbc1b46d989e5d578e

  • SHA256

    f31c503ee699ea21773589bcf432714f724613374a61e16e4cc8bbbf5596d5af

  • SHA512

    879ce4d25315e8252b1633bf417d21ccbe2d601bcf6e8579e7f4d57febbfeb39225f335a8594a9347d5472835ee9651be22ea0ceb0ae4f06c5f1acc1e0b471a5

  • SSDEEP

    12288:UFIQctGozEaVwSo+A4XSuS9ASxv9dtb3H4q6fB8O27N14IsAd3O0:UFIQc8+ENfuSZvxvBr4Jf2OadsW3O

  Score

  10^/10

  latentbotevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2