Extracted

• • Target

    c768f5f171dc87ca9201e84a4a5a2eb0_JaffaCakes118

  • Size

    600KB

  • MD5

    c768f5f171dc87ca9201e84a4a5a2eb0

  • SHA1

    1f07a86e1fef71109c6f3ea892f8bd451830728e

  • SHA256

    76d926a4c6adee4cfbc9a9c6a2903dab65429d73e3a3cab532f32f8e6713c2d7

  • SHA512

    d32a92794ae592347de5c0410fc5b3f7c1ef5d2e09e1e0287b5aa418d1eb9fbd63fd3a3f40a235653e110375a5af712ac4e7164a355833ef9b6218cbcc1260fe

  • SSDEEP

    12288:Q3Or9fnni4/HIz6bURUmMRVDoiTbc2eS8SuClkQP9Wc7m:Fo4/AAzBztgAjuakeja

  Score

  10^/10

  latentbotbootkitdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2