Extracted

• • Target

    JaffaCakes118_66301af21a6d3c474a81fb050851f13f

  • Size

    6.0MB

  • MD5

    66301af21a6d3c474a81fb050851f13f

  • SHA1

    10671df3cf035040c3c129b065190fb78d971b5f

  • SHA256

    cb61f9b9bb51d27d5b6f9d4ec0bfce866e872c5f843a804ec03667886af59287

  • SHA512

    30d19a65f42ba66db8ba70684615d8f80b202ffb4d1da2413286fa1f9cf96f95c97fa4e2a78185b523c24b33c0e10a5133d056234f55949d8287df0f8b618d64

  • SSDEEP

    12288:IrTjF3x8DPdmzQ7S8Ri1H0ZQRZkdkQXk8gAu26sVT:6slmzQB6H0ZOZkdk8PVR

  Score

  10^/10

  blackshadeslatentbotdefense_evasiondiscoverypersistencerattrojan

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades

  • Blackshades family

    blackshades

  • Blackshades payload

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies firewall policy service

    defense_evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2