Extracted

• • Target

    ec35e0825aae08eeae9659a8b3d9b8c4_JaffaCakes118

  • Size

    242KB

  • MD5

    ec35e0825aae08eeae9659a8b3d9b8c4

  • SHA1

    8791c12e8d95c13e38ce885e4bcf4da13f2273e0

  • SHA256

    aaccbe42e25e33b0e42f627ff4604ad97941b9ee5d7146e82d0e0179e15f074e

  • SHA512

    26eec5073c4515ab16075a7b3c0c6fd47d3e3dd42b0b8690dba308db3ebf2fbcdb4e7307c46dc4f90e30bf36378c6a5296ac431ee61bfb2e18a955894864683f

  • SSDEEP

    3072:LWrrq0RO8vAAvZNXUgGQQYI9wuCR/7PPxitQf/flBP+7sFXaAdJeoTIVWY19QdiL:CrmEOwAAng+uuzTNBfXV7etVb6iZwaF

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2