Extracted

• • Target

    JaffaCakes118_2ed6bcf450a60b56421411186efbc69e

  • Size

    500KB

  • MD5

    2ed6bcf450a60b56421411186efbc69e

  • SHA1

    3851bcffc77f1a14db1156dd7c31b3bacacedc0e

  • SHA256

    0a8bf81411c9e72304b1d49c804b84c6b29b1f92e084f1f91111989d666e8c40

  • SHA512

    123f57f76760ecb20281584fcdb9404415588640874ca39ba4b07ced3111ad0ab1734990220ee73748759c06379d3441256a572ffbd63c12a97086fc2f2e06f4

  • SSDEEP

    12288:LERH1S87Mq1HPST1flAco+4Om26E3eaRial:IRHsiPe9AXI6aow

  Score

  10^/10

  blackshadeslatentbotdefense_evasiondiscoverypersistencerattrojan

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades

  • Blackshades family

    blackshades

  • Blackshades payload

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies firewall policy service

    defense_evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2