Extracted

• • Target

    a8871e8d7fe2e9c0476b1b9c191ab16d_JaffaCakes118

  • Size

    868KB

  • MD5

    a8871e8d7fe2e9c0476b1b9c191ab16d

  • SHA1

    73f3bd2dde3a7c006276c8f3732cadf8ab0a01f2

  • SHA256

    ee268b91629f196135bc24c194a32afceddaf6b7db0b9d27bdd68818ad887016

  • SHA512

    d22d1e23bce03d604c4160f9a4eca30687fbc06d158b1d6111708977ae3c0b1fb0cd0ff4e4966d13fd88e7fcc54bbcd9e6964fb06ae39e1235016692273d30aa

  • SSDEEP

    12288:qo2VOCmcf8ySc8+i0jJdbBmvS2mIAwOh+2b9M204PnY8MQz5tCcAPzc5yuLofrgq:5a/pB2bmIkA2b9Z04PBMQb7i45ypzga

  Score

  10^/10

  latentbotbootkitdiscoveryevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2