Extracted

• • Target

    dd88fa62c426ee41fe0d21726ff48436_JaffaCakes118

  • Size

    1.2MB

  • MD5

    dd88fa62c426ee41fe0d21726ff48436

  • SHA1

    2e7e86d5705f3586924067c15a2cd1fc0a5fc774

  • SHA256

    3b0ec7ae2a4b5716cab4a2db57037ec1e3367b52207bf524617bc435df21d52c

  • SHA512

    e4bd6abaee97fef4f8fa9b2e0909225a325192e2430c029ab859da58eea7dc23596b977da221ca011548b69d3e600913322cbd1e28a07d1893e2c0c326b96e34

  • SSDEEP

    12288:yPdPvYWcBKKV5mHu9p/LsFF4JEEIjeEL0f4pg67ogS3HNPz+RaIKCzpTd9VsY1o9:yWBiu92cjlQp03HsbTzpTS2oLED9vYwI

  Score

  10^/10

  latentbotdiscoverypersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2