Extracted

• • Target

    960cc7c63cdfcdd1e5179681f10cf700_JaffaCakes118

  • Size

    620KB

  • MD5

    960cc7c63cdfcdd1e5179681f10cf700

  • SHA1

    f39416f678e8c91c5536a401f4f2cd5a3f5c883b

  • SHA256

    be307aa0440e6ba9a3e10997f64c00b317840177500231b3883fc0ded079c14c

  • SHA512

    40b0aa7c2c85251cfeddb67e50b51c5ef115efc7a737b0c32c7a402d800d231739f5e5b2cb78d8cb8e2e3c5c852432e1020740cdcae058e34d174881a7405e9e

  • SSDEEP

    12288:cOGLp2u9DjCUQFbD5fnv4t0tVxVzSS8HAgqtITKAUA4xvryRsn0:rK2UQtDVE0fxl2HXcITth4dGsn0

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2