Extracted

• • Target

    fef9306d079d108ba67c999310684406_JaffaCakes118

  • Size

    672KB

  • MD5

    fef9306d079d108ba67c999310684406

  • SHA1

    5d681af45a247cfc4b55861cb869bfaca917e628

  • SHA256

    afb0d03f8eea2f222c5eb4ed3779d976180e4d9bb4f75063988336488f3d38a8

  • SHA512

    5ee074b8e780d04305306514ea5756601f4878327fdbbe9dd2f4dfb6ea6864c416c447e85da8d9fbcfaecf37dc19378fa6e4436da4e3e1acaa48b0dbac075e65

  • SSDEEP

    12288:3zN59L8WRxStFP48gnXfp/YurF3X5mRi32tZxw:3R0UxStZ48gnXfVB3Jmj

  Score

  10^/10

  latentbotbootkitdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2