Extracted

• • Target

    f29cebec13239b10170d4ab18f500a9f_JaffaCakes118

  • Size

    141KB

  • MD5

    f29cebec13239b10170d4ab18f500a9f

  • SHA1

    4a85345921f537c8852c37e39b5d409122b34ce8

  • SHA256

    97f9d64f13c13f657e1a6ee124b5addb02bbf8e4c60746c29ca7ce80c617deb2

  • SHA512

    0018f27d80949be0c2d32857012b3ff8c73da774a089c5041758c97cbcfca0d616e776d28103794a0d860834767084a1f16096e3d55af678f15bfa168a480ec8

  • SSDEEP

    3072:6jaeY9QFVyoALuV2xnHNi+ofCSn8w4m1qjJK+nJ8/mpczn94bSL5Jfu6:jQ4A2HoDV4VjJNnJ8/cK4OL5Jfu6

  Score

  10^/10

  latentbotdiscoverypersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2