Extracted

• • Target

    30351a1788cfb3c6d870b7ca49035662_JaffaCakes118

  • Size

    336KB

  • MD5

    30351a1788cfb3c6d870b7ca49035662

  • SHA1

    7c51397ebb4e872a489ac5d11667a674e4117a67

  • SHA256

    b2a9a9fcfcf83a0b9d6e8c44458a0fcebe30786843d77712e030b677bf0ca581

  • SHA512

    44893aad6e4ae72c2d229f123497e7233e81f4f2250b5de37ca0ed626ca3edf7ebae84c1f17c4ed89c27fa3b59336707283eb4291b041a0b2a4412b5780d8f8f

  • SSDEEP

    6144:lG78LjzOANvSAsQLqF9pXMiY3sGB6UduRfLtcR:U7kmAN6omFMb3sGB6UduRfLaR

  Score

  10^/10

  latentbotevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence
  behavioral1behavioral2