Extracted

• • Target

    5375359139f753b0e34ee4e624c74314_JaffaCakes118

  • Size

    484KB

  • MD5

    5375359139f753b0e34ee4e624c74314

  • SHA1

    55a17280f67441abcd89f6e3f8aa6b28927c4e31

  • SHA256

    2667ffec3bbdc918875111958c1756eb91e4b9383d88417e27f794d7bb147824

  • SHA512

    3fbda33cfc4978a23078f6f21d2577b87cb3e2ad21229bafc13c4de1281e849c2f6039ba25548294726d92f01497c2e4bab30db067e476aa4a7548bd65630e42

  • SSDEEP

    12288:PdnqvDeXWDD4bi35EFvJVsAxmUx4Rk8L1bMd:Vn0ymuicTbcbM

  Score

  10^/10

  latentbotevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2