Extracted

• • Target
    fef9306d079d108ba67c999310684406_JaffaCakes118
  • Size 672KB
  • SHA256 afb0d03f8eea2f222c5eb4ed3779d976180e4d9bb4f75063988336488f3d38a8
  • MD5 fef9306d079d108ba67c999310684406
  • SHA1 5d681af45a247cfc4b55861cb869bfaca917e628
  • SHA512 5ee074b8e780d04305306514ea5756601f4878327fdbbe9dd2f4dfb6ea6864c416c447e85da8d9fbcfaecf37dc19378fa6e4436da4e3e1acaa48b0dbac075e65
  • SSDEEP 12288:3zN59L8WRxStFP48gnXfp/YurF3X5mRi32tZxw:3R0UxStZ48gnXfVB3Jmj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  latentbotbootkitdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2