Extracted

• • Target

    64db715376cd0411fe69dcfb6f342a51_JaffaCakes118

  • Size

    162KB

  • MD5

    64db715376cd0411fe69dcfb6f342a51

  • SHA1

    224a8607131ecbc55380a32cc4694d6609076fef

  • SHA256

    2dafcc925fe06bf8d5e057ba836cae0adeb0aa049240f70f2b80a716073acb62

  • SHA512

    d7a0f4dc81cc04db77e74c46ca2acd9bd2ea2a27b9fc6850feadf559cb116d7f2b33fa4c79d12055f4df78af5e37792ae1f09dcecd02685c64673f59072d11a3

  • SSDEEP

    3072:wOgpp9ARzWvkPeX+O4WylbzxUMyhdSQvdh6m8OBeETioMv:Nk+RzKlXuWEbzxU5dSiPBeAioS

  Score

  10^/10

  latentbotevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2