Extracted

• • Target

    c2127146937e1438408fb3b0569d0816_JaffaCakes118

  • Size

    526KB

  • MD5

    c2127146937e1438408fb3b0569d0816

  • SHA1

    59ad839546f713ac7aee357ea7c6b9a8b57dd920

  • SHA256

    11929d279c1f017543e61e616ca046c4ce3ba983b5b847896337ed58e6f10086

  • SHA512

    76e5a0c3e8aca949d6caa75b7cdd19fd04e3c821ff292223ad55c0b7989d4c7f575976fd8b0cf92a906d8d51e7a13ec9840d9d610eff926f56d93683b3e57e6a

  • SSDEEP

    12288:Ym/jlqCU+PLDLd6TkaqcyKsN1OsEqDJiCCCCJ41:Zrlq94LUgoyKRGiCCCC

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2