Extracted

• • Target

    e37eb3092d8fa42f9ae201a0228e4100_JaffaCakes118

  • Size

    568KB

  • MD5

    e37eb3092d8fa42f9ae201a0228e4100

  • SHA1

    8b3ded6ed64bb66ca7e5cdab8958646fa978aa75

  • SHA256

    b14e71d5bcad365216db8480e29b7b8dc8182c07e72a287fa470e08de0d9c20e

  • SHA512

    df14d17dca662b29317c11adba30a945a364d17bc0516edb6224c8874c17d8cfdad671ad8ab433aaf8b76137d62d82cfd88c52943ed3e9c4c0ab8d51cfb45ea3

  • SSDEEP

    12288:dPg3IWCxPUcpBhHtMBA07i2bGSJxAAITfhnFVel9AMi:dg2tUcpRVai2z0xdnFVel9c

  Score

  10^/10

  latentbotbootkitdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2