Extracted

• • Target

    31550ea9ecb8f994a288570b1644d114_JaffaCakes118

  • Size

    552KB

  • MD5

    31550ea9ecb8f994a288570b1644d114

  • SHA1

    c3964f36938b61a042db9f62786dcdd698fac656

  • SHA256

    5761f92d64b2e4a63a04a19fef6e89bf065e42db5c6ed8581a49033af83c8a68

  • SHA512

    c5c4ef36bef9985832713b356464ec252c5b732c627174ed4fae388d9e4ed4813050b036fa78d21318f871d2c5b841cb3e5771ca700bd20ee405fcd9f1358489

  • SSDEEP

    12288:F6H4stsS4q6o8LLr0+5NiDNm67wSXZxnMwtfbs8RvTpDz:Wx4ayrZ58/w8NfAMVz

  Score

  10^/10

  latentbotbootkitevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2