Extracted

• • Target

    3dbb00c31685692e642fbd2aad6a3d58_JaffaCakes118

  • Size

    451KB

  • MD5

    3dbb00c31685692e642fbd2aad6a3d58

  • SHA1

    8a3941564d1194deda519ff91d146bf0eb3392fb

  • SHA256

    447c83388c5421ae282ecc957bb30ae7b17e388b8dd6a9aa31a6700b4be72cef

  • SHA512

    a8efbc712991ee8b1194d1862f4d54337634d3628e464c03f061913fb6276a90920dde557e611cefa64a6afbc09d4972a4188dec203a381cfd60444815403d53

  • SSDEEP

    6144:2K3HTNGVvHI2zBHng5HaVsbZgRnyR4mULJhkHM6jI7H1D7puVS:x3HcVvo21ga0aQ4HLJhkHM6jI7VD7w

  Score

  10^/10

  latentbotevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2