Extracted

• • Target

    1055352791c46b8a94ef0372c6ed19ab_JaffaCakes118

  • Size

    1.1MB

  • MD5

    1055352791c46b8a94ef0372c6ed19ab

  • SHA1

    50ae3bf5596a3f3a8603041a8b682d0bd4c18fad

  • SHA256

    6db86df6a4d4a4f7f1988bf9a0138cec8ad6526491f7114bbb88e752798b77b0

  • SHA512

    9a0975e2a70d9266019124561362e8286945efd3455b24f73da0a7f3a50571e88737207e70710b0a62572d976ec593836b7654ad03a09c8dbf35b8ad5d48ad58

  • SSDEEP

    24576:CupRi52nSVkBIEWYzIDM6z185HhTD9Ctpr0hNSNV0M:C5VkB5oM7JBCtF9

  Score

  10^/10

  latentbotdiscoverypersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2