Extracted

• • Target

    be928d68e0e412826aeccea4c385895f_JaffaCakes118

  • Size

    590KB

  • MD5

    be928d68e0e412826aeccea4c385895f

  • SHA1

    a309dd565ebc796ade2df8962bf89fabcf561698

  • SHA256

    470a47c16294d724cbfbeff06ac09ab1cbfa26b9c16adf1adb1651c7ac9c80dd

  • SHA512

    5de825be8c7b9993459180dad125f9a2835738befd37270adf032bf87b6e2fcbfdf22f4be36b71329de091b581074cdc944a0fd20a45cb8a9cba0095cf557f13

  • SSDEEP

    12288:Pw/8IIyz3GY+O8tacPeor0/7YyCaAmyTaUVce0:Pwp7+/tNP5JrmqU

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2