Extracted

• • Target
    bf97d56c1cd112197f951653c2080814_JaffaCakes118
  • Size 748KB
  • SHA256 1669137d9d09ee215a11a0ec6685beac90196666c1d4d0afced0f633a7c8543a
  • MD5 bf97d56c1cd112197f951653c2080814
  • SHA1 08c28f3682b67fbc835f27e292eb4159389f62d9
  • SHA512 870add48eae58b1563ec98d9261ca59223c673baee1ad7f7b377506fbf00a61497c3f9531be66c4d80d692e20468056e3a55d0bc9e80a7e8bc4bfcf10ac171ed
  • SSDEEP 12288:rJ7neJelBrH9xbLDDu7JHixkVB4Fa6QmunUy9ZExR0HJDNrFJZndtbqOTSgcDU:r9x76FCWVg5unUyjK0tzJ5Lr2RU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  adwindlatentbotevasionpersistencetrojan

  • AdWind

    A Java-based RAT family operated as malware-as-a-service.

    trojanadwind

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • UAC bypass

    evasiontrojan

  • Disables Task Manager via registry modification

    evasion

  • Disables use of System Restore points

    evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2