Extracted

• • Target

    JaffaCakes118_352de717e25f6c048f5154769bab39bc

  • Size

    578KB

  • MD5

    352de717e25f6c048f5154769bab39bc

  • SHA1

    751685e2e91e6fd79f885973860a3224195a3353

  • SHA256

    43effb7157529306e23d6f25204e78c2155ee506c7191caeffdb7123d73d2187

  • SHA512

    f3e1a5a5cbeef33062044aa344c6e9e328206fe5a8944f2c9456e9937a1db009e5e34818cbf0d18dc6a77ee722cf7b2cec44cddc8b1e9925098f6ec9f03f4c88

  • SSDEEP

    12288:eH2WSVdepiO8I9mLvlrL+2rW2YIzMm/1/PD32Z9rgJJVnMer:LWSVVO8l1+CYkta0JJVnMer

  Score

  10^/10

  blackshadeslatentbotdefense_evasiondiscoverypersistencerattrojan

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades

  • Blackshades family

    blackshades

  • Blackshades payload

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies firewall policy service

    defense_evasion

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2