Extracted

• • Target

    6500db7ea3ab5075fb9e89baca79168e_JaffaCakes118

  • Size

    241KB

  • MD5

    6500db7ea3ab5075fb9e89baca79168e

  • SHA1

    a752f119ae6af9d09aa81f412ab186c215ff9661

  • SHA256

    9bfca08d6e025e6443bbf1bfd3fb5b6d639224ced63a2816a13ad41b205fa95f

  • SHA512

    515c8a65fc80cae52d2d9401f15b9ad1e1af81f9bfda2e82f954072bef4e5a70f67ab06bc7ad53df49e9825f497f75c15e4663bcba8947fef69ad2d353459b26

  • SSDEEP

    6144:JPTlpB/4Y0LkYEaB7mK83+IEK+Qu20rxU:tlpBU/E47mK8OIE/51U

  Score

  10^/10

  latentbotevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2