Extracted

• • Target

    JaffaCakes118_55407673b4b0f8e4b70f84e023e6c5c8

  • Size

    636KB

  • MD5

    55407673b4b0f8e4b70f84e023e6c5c8

  • SHA1

    8d8d3cf881ab164a82607aab62c10500c7a6c94f

  • SHA256

    422bc3be6b70dd7785780738ce03ca2a4483cb85bcfc4543bc056b9dd32b9a34

  • SHA512

    4cc32dd8951832d2d278e20013be15c0859ef41ec1f6318aa7832e8184ba5be37a7f85c5daa330df2ddaf01142c16e21fc828b4a47c89d9ab71de9e34c2b2511

  • SSDEEP

    12288:rqeIFfwruh1+087bqqPimMDltarvgjn7V+9yaEll:2ejrAEB3M3Wv+7M9ql

  Score

  10^/10

  blackshadeslatentbotdefense_evasiondiscoveryrattrojan

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades

  • Blackshades family

    blackshades

  • Blackshades payload

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies firewall policy service

    defense_evasion

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2