Extracted

• • Target

    a841e252c23486f997a26e9d2c9215e4_JaffaCakes118

  • Size

    280KB

  • MD5

    a841e252c23486f997a26e9d2c9215e4

  • SHA1

    c7ccbb71d61f8634f8bd82b30b6c9b3f7920db0e

  • SHA256

    74184679f934b6cdf11696c378236cdee45f1e3171a8e6660061fa696ce44d99

  • SHA512

    cb3f292e7fe7e2bba23fc0602592c2cc4cfb5cd1a5b0e179e66803660287600a8702bd00165a079442dbd3743a318e87678ab16a48fecbfecd21a3244cb14376

  • SSDEEP

    6144:hpWsjilAKubzU4TJQHXbAl4UZM+zfLp+xcc4lyh:hpWsjilAKubzUouHrRqM+Jbc4lyh

  Score

  10^/10

  latentbotdiscoverypersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2