Extracted

• • Target

    5300e40f5682656bfdfd156060de19f3_JaffaCakes118

  • Size

    192KB

  • MD5

    5300e40f5682656bfdfd156060de19f3

  • SHA1

    ea1a973c318e451b4ec458af5d6946da37274624

  • SHA256

    c488258e43c071736fc9ee54e8d2a5847ae8b0d98f8b44be0a65478cd057e1bc

  • SHA512

    38f699bf5976a3b92d457485c88782e58a94f3691d3ddf89eb46365a2d2dd68719b9d17f77a971b3976e249a068432ef9bfcdd570fa4ffcd91fdb622ce42c1a3

  • SSDEEP

    3072:9956gt/E/Nml9R2wvunEQfHy9YEbaUk0QvuNlRTHvMfHxgZlBlEUsqRCmRO0:X5rt0twvgD/y9fbrk0WuNlRHkvIBaqIy

  Score

  10^/10

  latentbotevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2