Extracted

• • Target

    4d656973c594000ad7382de96f9f23b7_JaffaCakes118

  • Size

    121KB

  • MD5

    4d656973c594000ad7382de96f9f23b7

  • SHA1

    b916802136e3e327a79936d0f2d215df92c9bd38

  • SHA256

    97ba3016080a42f7f6a93e8331d39a81c5be5f642b0ed2df7f8673477c76d494

  • SHA512

    2c8e057c5dfc2586960debca3959a434a397533982bdf58cd05dbae766bc6e1efcdee9f99896abe871dbc3fb6ee92087031ea5558dab82108e8130516797d3c0

  • SSDEEP

    3072:qcC5FGLe0znxCH4CgKmPYwQIQDIrZI1owyZN6Pp:E5b0pCtmPZQR0rW1owy+

  Score

  10^/10

  latentbotevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2