Extracted

• • Target

    2e0af84f66d41d82bd31910925ff0586_JaffaCakes118

  • Size

    416KB

  • MD5

    2e0af84f66d41d82bd31910925ff0586

  • SHA1

    c3c48f53fbafd2b5e225510c8c06ca8652a101e0

  • SHA256

    223364303e379b4167dfb88d14588bdefe813fd5739c3d4b4e31ddacd7eb2652

  • SHA512

    fa9c26701341030b43c5abfa4e518924eed80dafc058510d43baf7a580cc8dd712b114df9da3d91c9824542c70b663e4e6e7ca30ae5b6e058f642bf13c80fc7b

  • SSDEEP

    6144:azN59KE1Lr8Wg4910iZN5xlCgNrmeSGUxIjJoKFpM61Uqo:azN59L8WhNLxlV1pSGXpz1UL

  Score

  10^/10

  latentbotbootkitevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2