Extracted

• • Target

    bf97d56c1cd112197f951653c2080814_JaffaCakes118

  • Size

    748KB

  • MD5

    bf97d56c1cd112197f951653c2080814

  • SHA1

    08c28f3682b67fbc835f27e292eb4159389f62d9

  • SHA256

    1669137d9d09ee215a11a0ec6685beac90196666c1d4d0afced0f633a7c8543a

  • SHA512

    870add48eae58b1563ec98d9261ca59223c673baee1ad7f7b377506fbf00a61497c3f9531be66c4d80d692e20468056e3a55d0bc9e80a7e8bc4bfcf10ac171ed

  • SSDEEP

    12288:rJ7neJelBrH9xbLDDu7JHixkVB4Fa6QmunUy9ZExR0HJDNrFJZndtbqOTSgcDU:r9x76FCWVg5unUyjK0tzJ5Lr2RU

  Score

  10^/10

  adwindlatentbotevasionpersistencetrojan

  • AdWind

    A Java-based RAT family operated as malware-as-a-service.

    trojanadwind

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • UAC bypass

    evasiontrojan

  • Disables Task Manager via registry modification

    evasion

  • Disables use of System Restore points

    evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2