Extracted

• • Target

    JaffaCakes118_15c5103f747e30316a15123233b0b6e5

  • Size

    865KB

  • MD5

    15c5103f747e30316a15123233b0b6e5

  • SHA1

    d63a099efec842ba512cd919224acf358fa3b707

  • SHA256

    4c04628b204560423346bd75eade2ca345f680ca7601c575b7ece211c239a02f

  • SHA512

    b154115ab671b84a488ab31d3ae12d5deec621530f30034b2bd916b04d82411d3f444c4a26f30d4ac85d3828dc43c029b9f468158f111816b75a187b6c6775d1

  • SSDEEP

    12288:PVbUuHUDUW8ZMKf2aDhDrwPkB9iwiynasec4rxM0u7kgQIhDGVvEId:PxUupD2aDZJ93D1edi7tl1wT

  Score

  10^/10

  latentbotdiscoverypersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2