Extracted

• • Target

    dfde0b66c32f9ed92c68e5ab6b897612_JaffaCakes118

  • Size

    239KB

  • MD5

    dfde0b66c32f9ed92c68e5ab6b897612

  • SHA1

    7edd14f1e85150776d4db811713b31cb74445bdc

  • SHA256

    d18e0eff8d1684c7a0ba19b9340016c666de9555e635f97fd71b4ed3cb5e9c8a

  • SHA512

    c6f69d74c659908d96e4e0a8215950f32f4de17eb01bd1c2b5b5dd5c1ec54d6e610c52d60790ab64f6d078e081567085bde16da159e814d5ea51f400a7af91c3

  • SSDEEP

    6144:Yyq8nmgtRgUHBgubUXt1bTSduS1WvHj1Fibh:YyvmgFHTbm1qujvZFib

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2