Extracted

• • Target

    46c2c136cc7deb4b5aa5e21238ebffc1_JaffaCakes118

  • Size

    41KB

  • MD5

    46c2c136cc7deb4b5aa5e21238ebffc1

  • SHA1

    f4e4081a1a9c95dde3afc2f65bf43e4309017bd6

  • SHA256

    0595b0fcd27308f51df3311427a3df37302b358e7eed02d611a752060f72d441

  • SHA512

    de1ef8c8f3e020d18f687f5e25de648427dadf139865fa9bc31f8f1c3e95cf34254e67350a34f634aaf908b999f008d774135169410d504868d457ce775a5c6e

  • SSDEEP

    768:+C+RyGe4wYPjAUFyATBtoGJh9xTZ6bN35v+OjoY:+YGCCA5Uh9xTuNJBoY

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Modifies WinLogon

    persistence
  behavioral1behavioral2