Extracted

• • Target

    b296580f06b72926fa7c6c05c4ed155d_JaffaCakes118

  • Size

    548KB

  • MD5

    b296580f06b72926fa7c6c05c4ed155d

  • SHA1

    7ed23fc22fab6eb90932b98a697418b3b043ebd0

  • SHA256

    6941d29fab08629922e764b456b5e01451c5d5984014c9de593cb8f7004f4cd8

  • SHA512

    b1348ed5a17fc1b0d1ec38062b52a0e34cef375a37cc7998a75a89048f7c142f9fcdcf02cfa1b31fe24787435faf64b77969ebc0ca63aa37de416c2c32a9f3f0

  • SSDEEP

    12288:Ho5uZlwn6tTnGnvlhZFzGj/+8HnhbG+bpG45:cSw6pGNhZ5Gj/+8Hh3N/

  Score

  10^/10

  latentbotbootkitdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2