Extracted

• • Target

    50b067d194db365556335516cbba22cf_JaffaCakes118

  • Size

    672KB

  • MD5

    50b067d194db365556335516cbba22cf

  • SHA1

    5910517295a8e049f5db0b72c2e430287be58c4c

  • SHA256

    e5d9154ba95749fedefef1965592632f3eb362082288fa4cb92a17ba9de53df8

  • SHA512

    5b423a33dd156d25e4fb1230a00f07be35c37a97de3bf59dcb449e02608689c2c48f85676b120a0b3661aeb6e69c88968eb35d450c0cad051e6ee5b45a6b4d85

  • SSDEEP

    12288:lzN59L8WfBCK87ggbQbmpNzlgqBNXVQOU9oMqFe:lR0IBtHqrg6NjU9oXFe

  Score

  10^/10

  latentbotbootkitevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2