Extracted

• • Target

    JaffaCakes118_b4334f4a1b5e6e32edd4aece62f6dd60

  • Size

    18KB

  • MD5

    b4334f4a1b5e6e32edd4aece62f6dd60

  • SHA1

    e7129988e6ceab9de42f02175483bf8b41bcdbd0

  • SHA256

    aec33556317ddebff5b8dbe3a2fbdfb44bd7865b693dc76c3564da791657d63a

  • SHA512

    3abd16ab574315584e45d2e3dbf14fd2d37423c95027d21526f12e70a7c91ea0a0c084b43ef51e047a2bb1958fe58512b3d7d9b90cb0d5e6ca4a8090717efdd1

  • SSDEEP

    384:cKbEq87nRvT/EXCL1SLcr1m+DFi3ZkjvQCkF63HeFvSgn46I/hxtXO+m1X:UqAnRQXwRWKh+FvjFohu+Q

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies firewall policy service

    evasion

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2