Extracted

• • Target

    JaffaCakes118_32cd46571103505d4e8d3792c9940d0f

  • Size

    812KB

  • MD5

    32cd46571103505d4e8d3792c9940d0f

  • SHA1

    6bc3c6caadf790731094740d01a9ff971a24a5af

  • SHA256

    545f929e2befbaa0cebbddfb67c612a4e1363be1fde222e8271bd8fa324f2a5c

  • SHA512

    b6387a5454f528c61b0f07ad5b4b49a13ad3ed19508deebb5535dfbb81e4f1ff952fa360fbf4030b9c216b0ae8994b670c963cc278bb2008ae06400222c6c91e

  • SSDEEP

    12288:l6Q8oSIgiypnOyJLu/BhW1gXAY39ZiGHUQaLBb5byhQxNiMhh5QJpbKZwZLpKUtx:JdxT

  Score

  10^/10

  blackshadeslatentbotdefense_evasiondiscoverypersistencerattrojanupx

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades

  • Blackshades family

    blackshades

  • Blackshades payload

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies firewall policy service

    defense_evasion

  • Adds policy Run key to start application

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2