Extracted

• • Target

    7eedb29e334df81a1cb3e903ff54fab8_JaffaCakes118

  • Size

    486KB

  • MD5

    7eedb29e334df81a1cb3e903ff54fab8

  • SHA1

    e19421a8db6c80b277e4e7f41706ada611c4c9b6

  • SHA256

    5b4a4548605acece372ff9bedaa7095331b3abfe1fb602cf8b378fd0e3d15d14

  • SHA512

    c70ed6c62a2ad03e5f58db7306bc5849129c3fdc1db30f2540ce9d51f18924221053b57503e717a9436a9c8dac8e55a5b9f78142880b6d6c5fcbd3446241a74d

  • SSDEEP

    12288:7baSTgd2cCMXKfDARCTqdQYLm3sgSG735OKPOA5H6KSoS:ud2XDARCTEQYLRgZr5NH6

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2