Extracted

• • Target

    3f7b736908e8c6f0565724d1becc18cf_JaffaCakes118

  • Size

    813KB

  • MD5

    3f7b736908e8c6f0565724d1becc18cf

  • SHA1

    310dcc710d46303ea4b76fdf27920f1444455630

  • SHA256

    f69e5c5e7fc9a922ccd20d4943e5b1879e1edf7894f741a69599b353f979f92f

  • SHA512

    587c304117723445a205fba2bf02f85c56b5fa13bac88ed2377e4e50573979df0ce18006a8ba33344eb7033f74a6ffa2b19adc9f48fd3e8ffb56967f3f2ada27

  • SSDEEP

    12288:cOcNFX1jLYjRbd5AjFXuO4Byq7EcdWd+Qb0+eE08dY8IkD+myR6INFBI7hf6Kujx:cOO/cda+O4kMV/+i1pc69o

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2