Extracted

• • Target

    32b886fdb5e83233af6a8d3f363f05f3_JaffaCakes118

  • Size

    440KB

  • MD5

    32b886fdb5e83233af6a8d3f363f05f3

  • SHA1

    b25ec4aae7e71f36e0afa7147444583c9eb0d3d8

  • SHA256

    d90ff25053f358d46bd8870a2af95581b8b8c08631aa930a79b614a109f3e836

  • SHA512

    225f4c3fa47a6f3ed5394e0e4ba4d826787717266076de66dfa8f7810a55a7513c4e7b6110bdc81c409b993824bd4bb672a3f77c456d4a552e77bb62e369ae58

  • SSDEEP

    12288:eOgSbLhm2r6UONpE7FAHk7eRXJJ8FmTJcUU53zCH:+VNpE7sOHuH

  Score

  10^/10

  latentbotdiscoverypersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2