Extracted

• • Target

    5b38100c0b76dc987526d984ab9f7e74_JaffaCakes118

  • Size

    268KB

  • MD5

    5b38100c0b76dc987526d984ab9f7e74

  • SHA1

    152a1dfab935cf5031715d8f28943911a00e1c84

  • SHA256

    0366ad240307a5c4484fc5533bef254aec27637c10f3672ea9806197b0ba9cef

  • SHA512

    b75e6acc7d3c0cd94139852a82fe80805f1fdbac6479338bdf32bd3e0794fd45ad5a179598b73efe0edade245be67a1c0b5c48f589c61aef48f05a8fdd21fb52

  • SSDEEP

    3072:QXHRmjsitDUxjpOXhX8EtwUjcDxQv/lS4nGArAhhwNAfexn7FKc0uVd0s7jJoH95:nEkxbwUw1QvIX7uAmSc9xjKmg

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2