Extracted

• • Target

    bdc7e4ee0241da0140ce0eda61c8db85_JaffaCakes118

  • Size

    18KB

  • MD5

    bdc7e4ee0241da0140ce0eda61c8db85

  • SHA1

    2b4514665d8118c1f8e84f566d1730587de20934

  • SHA256

    c27b386c0dbd2205ba34235bd018f7b3d0d02aefc0f9723cc9d6a20f0e19e0d0

  • SHA512

    dfccbeed9026d49b9760bca318354556d659a4ff660a9196daceccac99d251498dbb9e8ef387b052def5fccd03084d9d1f593c80ae1375506d5fd909d511444b

  • SSDEEP

    384:cKbEq87nRvT/EXCL1SLcr1m+DFi3ZkjvQCkF63HeFvSgn46I/hxtXO+m1X:UqAnRQXwRWKh+FvjFohu+Q

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2