Extracted

• • Target

    1a390ce9a38656bacbab2c736b376086_JaffaCakes118

  • Size

    342KB

  • MD5

    1a390ce9a38656bacbab2c736b376086

  • SHA1

    8ed6c5c558ccef8562e9b414efc258933e60ea6f

  • SHA256

    c4301978bfe1f1e601b8a9ccc63f2fbc4590b74bb46d6a95ed26f72a12556daa

  • SHA512

    a42b3754c2e1ebba6c2cbae61825243f93c3d1322c08c924003a53af10c9fbc9c0f9d07854dae9a1cffe2ea99986cdb0250c6c9989abbd65c8c6c7d7eaf44a8a

  • SSDEEP

    6144:9Rqmpp+amNOGokzLyM9tsLAitQo6tzOKkzIt8gKyfjxfR9D2j4yXoQHtVee:DqmpplpGoGL3etQoMiXM8gxf/Sj4yXlu

  Score

  10^/10

  latentbotaspackv2discoverypersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies WinLogon for persistence

    persistence

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2