Extracted

• • Target

    08dad122feeb76cad7ffafcd9f81aee1_JaffaCakes118

  • Size

    1.1MB

  • MD5

    08dad122feeb76cad7ffafcd9f81aee1

  • SHA1

    df3f4229405825d486c6ab5afde6ebcb5ae8fd54

  • SHA256

    5924f706585d42c20a5236404c6bf3b27e37184b5dc9870f5c6fb7b69ce54838

  • SHA512

    c40fd8705845939c6d20aeb42a187f9f106a4f31a6a2b7946716d237d9df68787c365387fb6d7e049cc0dd578b59f698359f1742064e9ef1e9ba0146d75547d3

  • SSDEEP

    24576:CupRi52nSVkBIEWYzIDM6z185HhTD9Ctpr0hNSNV09:C5VkB5oM7JBCtFY

  Score

  10^/10

  latentbotdiscoverypersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2