Extracted

• • Target

    e61ae658623757a058841a4fb9a4aa4f_JaffaCakes118

  • Size

    194KB

  • MD5

    e61ae658623757a058841a4fb9a4aa4f

  • SHA1

    bf31e71aa2808386f5404ae83f3b8e5152663c94

  • SHA256

    87dcad6ea38b48198c1e5852f056d4c9f6a0792eae056fae05c89d1d18abd7d0

  • SHA512

    52a67c05423876a33fc8752ac470f516c759e9de76d639c7f00a22c087076a272e9e24dd52b213a2d4dea2e4026b7516b5d5972612be76d4a9b5d3f6e1893b17

  • SSDEEP

    3072:fN1kjcqu7PCRlD9B8G8LQsXzyKpUcfrFSmz6q7tvkvLpFUaAuYWwNIMT/XvtouP5:Pe8PGpmJExKPwm2q7tcELuvGrlAW

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence
  behavioral1behavioral2