Extracted

• • Target

    6ef0337bdbe921bbdb8192c986366f2d_JaffaCakes118

  • Size

    548KB

  • MD5

    6ef0337bdbe921bbdb8192c986366f2d

  • SHA1

    eabe05484c36c0d77ab8f45ccf8f0a583e1965d8

  • SHA256

    ee2f14bed1ecf48bb01ec3dcf20a4267fb9b25faf09eeb0a34948b654e8e57bd

  • SHA512

    af3ec07a7a5700531fb82ef3efbe23007d83dc27a4f15a29d79fab916f2f842a83d52588ab0f7613e63d2b677dd917137d4a49e32559860878245f2d11a7987f

  • SSDEEP

    12288:s6H5wb0KYWrOaXcZY9oRP7sHc0aL4UZn370EpeAXbsP7MAxZsxQ:MbeWSucQWsHeMUZ3YIE9rsx

  Score

  10^/10

  latentbotbootkitdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2