Extracted

• • Target

    a7ec1cac71bfcadd2d10dcfe3384bd48_JaffaCakes118

  • Size

    332KB

  • MD5

    a7ec1cac71bfcadd2d10dcfe3384bd48

  • SHA1

    e42c1ea137e16f3a68a0be22c09b402245e4fbd1

  • SHA256

    72ed0eb647ca76930124b97feaccb52446559e4da597d3c4f9e487c4771ea2e3

  • SHA512

    98637e4758801404f52c02afbc1fb445dd17bc972a95fb4aa4470ac4127f85c95d8e73ca023efd04f60494481b7e4293d85132eb31924996af9ee3108aad9aa7

  • SSDEEP

    6144:uiu0srKxP6nVMg1FENy/V/5c6thb+lazG8F:u50srcyLjN/5c6thb+lazGk

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence
  behavioral1behavioral2