Extracted

• • Target

    901b5eaf48ea40610ce1689884438aa6_JaffaCakes118

  • Size

    467KB

  • MD5

    901b5eaf48ea40610ce1689884438aa6

  • SHA1

    cf9a1809ef13d30535fe3f0192d5529fd0d9c951

  • SHA256

    41582b7f0f9c8a40b285141acdb95ffc1940dd70b6c7e82ad05f0b0521bb2e68

  • SHA512

    823c5fc2dfe358cf71c1db0aa501336ecf09518e670be33b41bad1279049d39f44b626df4f132d272c354dde4b326a6db7df6cd18c413d5f518149be34529110

  • SSDEEP

    12288:7G+wyunrVMw3qcCNiLEgs2xzidCU+9Ge5:7G+wyun5KNiAn2xzvge5

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2