Extracted

• • Target

    931f9b49da3148fa20689f77153b59d2_JaffaCakes118

  • Size

    3.0MB

  • MD5

    931f9b49da3148fa20689f77153b59d2

  • SHA1

    e13a0d13be83a6ee19bab2e1ff99276862b043a0

  • SHA256

    635a33bbd24779423e271254e335b860ef9decd8670240da8756d4f05c17a782

  • SHA512

    74be5f81122419a97684493b88e5690e0f9a9e91d975b51fca0e00d838365923092635f47a51e651bb13d5ccd975424343b54a61623c25b10516f7a7527e5710

  • SSDEEP

    12288:a6eVQkTrvj4d+dONGRpz5ljXeLY8Kk5tqGN0GvTBb/A4h75L:anQkTf4d+INGxetl0GrBb/A675

  Score

  10^/10

  latentbotdiscoveryevasiontrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2