Extracted

• • Target

    JaffaCakes118_88b004bce428f2f025f0415da2b286ef

  • Size

    636KB

  • MD5

    88b004bce428f2f025f0415da2b286ef

  • SHA1

    a83183de34a0140db8cd069eecde781a84204df0

  • SHA256

    7e60635031c19443578bb2982d257e786e47a9293e741e89f815bb9f8ad19a9b

  • SHA512

    3afa6d7bb5438741cf217184eba4a38d61f8e9b55be3ba6ab423b9d89b55125b462138df7305c6216c20efd20a24a192c71429b08d7422b90e0e673885454a2c

  • SSDEEP

    12288:vqqxyW9TRoypqGgbZDvNL+rao/dCMZFwVEt7C9hiULh1:Xx9T+yraZbt+rawZi6W7ic

  Score

  10^/10

  blackshadeslatentbotbootkitdefense_evasiondiscoverypersistencerattrojan

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades

  • Blackshades family

    blackshades

  • Blackshades payload

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies firewall policy service

    defense_evasion

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2