Extracted

• • Target

    816aecef6b2d57b86c85083a5645597f_JaffaCakes118

  • Size

    423KB

  • MD5

    816aecef6b2d57b86c85083a5645597f

  • SHA1

    c8cf97874e16062094756c312c91aeeb4e60da3e

  • SHA256

    8ba86a9743e93c3cb59d4e030ea1fdd0aa3a300a28822c58329cb55ced05ca3c

  • SHA512

    d6244ff5b73238591717d1fb6f7db4252aeb4da776c813d800a0aa8c4de1c2c36f5d054071b8a573b9f03f1c2a52d1c6b6546bd8f2f092c167f2941df47270c6

  • SSDEEP

    12288:GAxGI+PHohOH3GczOHw18R72Hfn9wKmoCkb3XkkKAoS:aPIh8o4wKtCkbnPK

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2