Extracted

• • Target

    cd055487e5a225b588ce9dae4642376e_JaffaCakes118

  • Size

    440KB

  • MD5

    cd055487e5a225b588ce9dae4642376e

  • SHA1

    7f353f17e3d6b2d9cc2f1185aeaf3c86507ef685

  • SHA256

    54815e9aaa80fbc9e97623bdfdc456260999b1016507a379b18a865411953d30

  • SHA512

    32d93746474827c364674c035b82f524b2ed24edf649972f3c92edb3f1ad4a29fa7834f42ead2a18c90f06ef866ee38ba72b5add9568d487c7151347b44fbd29

  • SSDEEP

    12288:bE4ZuPf8b7naROqDEAXZ+DtzyICYBs/O:bEKSf8PaRnEcZbfO

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2