Extracted

• • Target

    ead1fdb488cb0146d566afd8cefdca87_JaffaCakes118

  • Size

    584KB

  • MD5

    ead1fdb488cb0146d566afd8cefdca87

  • SHA1

    fa7aa019eb888139f75ba66443e98308221d9685

  • SHA256

    3489e4cbc671aba97d436a070dcfbdc2dd07be9939a06988fa127e4c6c812b87

  • SHA512

    88e253c58e4285411ebf6b49fc271a83ec6f3831a2515a4b13c54d8c6961a7d492f681f8817e2aea853eb171e23f0fed6a198a0ad958ff1be7c2d9c48e7ce622

  • SSDEEP

    6144:Jm0uLGfyyJQptTF4zAmhXKE5PP5Uw1CL6OM6ngT+61X4stakNtWby4tWtCwIjZtM:Jm0uLGqyJOf2XK8Sp2OLQTZlIjZ3rx9G

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2