Extracted

• • Target

    17df9d337809d557f3c4e591c8f1a689_JaffaCakes118

  • Size

    727KB

  • MD5

    17df9d337809d557f3c4e591c8f1a689

  • SHA1

    51a84d6d5876008704953d94c29cdabb9c329981

  • SHA256

    b11c239b98fcd212a5733e2478e06355a4158ab80149426a958e1a5073b992aa

  • SHA512

    db95f2a582b46c8e23f6cfb195096c39cdffaacdc3cc602fd1a9035d95380d2fc0d166d54fd75e04bb67e4800a2454fe67c1b68a83f9a63738f15a97ea34e092

  • SSDEEP

    12288:+DMpJc2tztOMnROzV2zbqwzTKeWy1qH95VshSIasG+o0eY7YGAZ5lH:C3c7zZ4o/asDodmY9H

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2