Extracted

• • Target

    JaffaCakes118_2f3a3bc985436d2183768446b68ee80c

  • Size

    224KB

  • MD5

    2f3a3bc985436d2183768446b68ee80c

  • SHA1

    6753dd23f5c0b4f00151213f80f236422563e6f8

  • SHA256

    270693aa07ef0a5051a23851fad30a17baa389fb28ec2036b7eb1e956b97c4a4

  • SHA512

    54f9b5a9f7bfe0a914dbce0d1089e7f2e7248f0bb8db4cca054d22cb8742b6a921f6ac9140c51de23c3cf19953f9e35bf7aecfa9a4fe7b3d19329e52388c6524

  • SSDEEP

    6144:TUb3c1uPonLHOGIbH/cDSqFXy9q1Hmv7SdMBslT:U32uPELHOFLhqRmzSdMY

  Score

  10^/10

  blackshadeslatentbotdefense_evasiondiscoverypersistencerattrojanupx

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades

  • Blackshades family

    blackshades

  • Blackshades payload

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies firewall policy service

    defense_evasion

  • Drops file in Drivers directory

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2