Extracted

• • Target

    ab24881206e5c6b0561433767bc2a7a0_JaffaCakes118

  • Size

    583KB

  • MD5

    ab24881206e5c6b0561433767bc2a7a0

  • SHA1

    82a837432c501598dae94db20d514d1c169fe60c

  • SHA256

    62ddf55f47ce5a250e620e67b0e649fa214cfa2f6c013f9147cbc9c3f11413e9

  • SHA512

    c21c6dab2e30b346476b337dbc2a198d7ad1f93265e37e32bb4039ad065b8c1edafa95ee09acb7d1292e919ddfa6a04517faca15d41f4d3efd7ba31e11bcf8e1

  • SSDEEP

    12288:PtlRXllIgeDx0Mv0jG5OIf6mr8h0cO2GKiJEoGmCClL:Ptlige+Mv0CIQOv5z3mCCd

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2