Extracted

• • Target

    5f42b865b5dc3a1e092db625efff4447_JaffaCakes118

  • Size

    489KB

  • MD5

    5f42b865b5dc3a1e092db625efff4447

  • SHA1

    32da1062c067550f431a4580485a60ea7a657121

  • SHA256

    2e58c61a2ec3f9cd6a268aeca6826899baf7b50b95e990bec859b7f7c44b452e

  • SHA512

    b73239a05f3e292c0ab65e4e06deb01dbaded060471e4d79561cd065c12e2d7e2c1841d2c713330669790bb37d64e3a185ab940ebec995166497e56e32ca24c0

  • SSDEEP

    6144:zxhdgS3S2bq4AQKtztEeQRYWbUV3P2atrZ3:zHdgS3S2bPKt7QfbUl2av3

  Score

  10^/10

  latentbotevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2