Extracted

• • Target

    567011a9f1f4d04e6405f7c343deb67d_JaffaCakes118

  • Size

    193KB

  • MD5

    567011a9f1f4d04e6405f7c343deb67d

  • SHA1

    bb6144594cbe4fffac20421c3d0013cc20ec8c19

  • SHA256

    65f36d5e606af1c0c2f7d4f5103646f769c22e4ff4aed88476438662316d5da5

  • SHA512

    f78014f1374d8914409ce48722cb1f8b4c3254afdc5a7bd001d45c964f993822037a4fbbb3d882c2a5528a1daa7063f4f7abb21f25a32297ee58d946c6d5240a

  • SSDEEP

    3072:ipEiMxnf453AHnkh0vIy+GM1peZtWoA0iLmemn3cCV70P4kLY9Km6Vpr6mptxany:igA5g1QHp4AFmns1XY9B6/Gmptxany

  Score

  10^/10

  latentbotevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2