Extracted

• • Target

    b0afb5aafcd854e65057aadd9a68038b_JaffaCakes118

  • Size

    151KB

  • MD5

    b0afb5aafcd854e65057aadd9a68038b

  • SHA1

    f00d78240735c8b41653a226769793e719b5b0a4

  • SHA256

    bcbf89fb28d5c4e3b15bcce3dab09988e172da05bf139b01e935799e9ab81292

  • SHA512

    99a0e9155e458160acd1e9a5197ba4d7fbaf55b9d30e74442c532e570e3748bfb20e02b1742fcfb642b6f9f61cbe5f030c1e675e59749bce003f7e6d23eeeff4

  • SSDEEP

    3072:Y/NLxbeN3Z0l+wLslelQgJFlOK4aesYtJ2YYGJqbMi:MNLxbapPwLGehFT4FsYT2Ye

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • UAC bypass

    evasiontrojan

  • Adds policy Run key to start application

    persistence

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2