Extracted

• • Target

    67be4cb241da8e525ee2c6eed0360168_JaffaCakes118

  • Size

    672KB

  • MD5

    67be4cb241da8e525ee2c6eed0360168

  • SHA1

    9c45aff53d387083f883047680a52e2e7e1835b4

  • SHA256

    63566391c791e20b7582f12770587664652de3ee9ec01878989a897eb7e592bd

  • SHA512

    307dca00363eeee1c5e3fbc5e30234e70a0a441e38926bed2f795008bcabf1e5966b23411fc4e87b33896aeb102b3956d7fb3f13d50a5e994b79d32943671d0a

  • SSDEEP

    12288:8t4EHzD0+6FbfETQXJpvIbmWHnSFX6d1sl+NOP1BaWcQcyG5OtN:o/+ET+QHKrdBaMtN

  Score

  10^/10

  latentbotevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2