Extracted

• • Target

    e5ab19cb0f6618149f7dd9f2c990e2b2_JaffaCakes118

  • Size

    305KB

  • MD5

    e5ab19cb0f6618149f7dd9f2c990e2b2

  • SHA1

    2cb750109bebc42a87032751ab0e5479c254ee0d

  • SHA256

    19b82a821a924b81cad886c9743dd71e5cf63e2ed2074c5a3c60be63c8017140

  • SHA512

    5b2eee179b122bb2d6fcae811df6d7f41254d721dcc059aaf75efcdefc0bbe0d8bb13235e8335a0f2d82d81b030686a0773e8de8a86be2c5844bd8b8cb20b124

  • SSDEEP

    6144:jb8Wt7QP7gCO5cOFmRnptuXHejp2J2iPHpc6iOIsaerGQlsFa5dsMco:jb8WBxCOSRnptO+jp2oScDOdaerGQ8aJ

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2