Extracted

• • Target

    f654851c10b036e7d4fa08f5e7dd58b8_JaffaCakes118

  • Size

    548KB

  • MD5

    f654851c10b036e7d4fa08f5e7dd58b8

  • SHA1

    ce9f58f7a83743d680dfa01747b44d00fd873b32

  • SHA256

    c7d0fdb9f862ade43651501151792412ed9edb0a9fc9076256a379bad5e91f69

  • SHA512

    cd2a57c9cbb77ad01dbc90e3d29dcabdce9ce629a775dc12f340b81fd33c5ee8b2b2c546e22d4c678733c54a54cb2407ca62745c7f40fe7a15f5d7a75fe380f9

  • SSDEEP

    12288:Mp7t+hiD9Y27bVIuZeUEXhcWp19xTdkx2O5IVh0ysu1pWJNsD0gZ3u:UEiD9YAJXoUEXhcQ1Xax2WIVOLunWJN8

  Score

  10^/10

  latentbotbootkitdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2