Extracted

• • Target

    c320c558a90c42a9c570dc2455780acf_JaffaCakes118

  • Size

    573KB

  • MD5

    c320c558a90c42a9c570dc2455780acf

  • SHA1

    7613cfd2cc7ba8e63db2c922abd6106ef19bba5d

  • SHA256

    662ea90b2fb0a9be4630a36eb54a25f95de350ecdd29c1b12f4ecc1c7469bd93

  • SHA512

    a7d4897401a06c4b119a23a6af52ea76193b3a3ab2c9002357e6af584358b82a36b7757f24e39922212fd23a2e4c27999586e78d8b5f014eb0ef1d790df0374d

  • SSDEEP

    12288:io4764ic07rICLkro9HnDG91RTmjd0EnSlGZ:ioU8XICVMmj5SgZ

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2