Extracted

• • Target
    1e55b3bf2305ba0367f24d4d8c9f123f_JaffaCakes118
  • Size 192KB
  • SHA256 c15796a39443c2cb951d0fd15728eb80c45bd211998a12f44593d62ef76eb999
  • MD5 1e55b3bf2305ba0367f24d4d8c9f123f
  • SHA1 70a6305c4a097b8acaa37f7eb8cd136aab29da22
  • SHA512 37565c8e115e7258762112175a2b888d843646a6ac06dbf76a6ddc6f48c9d3cad66bff3cf19f07d7c3749e58d41a63a6f2eec3780413ffa796938e47912e5c56
  • SSDEEP 3072:Hu6p8wZhVB8FjHrLGd+s4W3QUC1o89C09s7t7W77fj6gyqmwjYPegmhn+VeBhCAR:HXDD/8Fvzs4W3TC1rCNti77b6+mw0Wg+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  latentbotevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2