Extracted

• • Target

    JaffaCakes118_3bd7458a801d40cf6c3945d462bb83e1

  • Size

    448KB

  • MD5

    3bd7458a801d40cf6c3945d462bb83e1

  • SHA1

    75b6a61e82a4759febd008b6245a49a4d7503a66

  • SHA256

    59e56524d145bcf01af9b8290cea654bac28263969c902845ab4c9d54071670f

  • SHA512

    1916476454fac63041396c5975994388ea8190570cd44ca5839815fcb332f1b485d27d98555c990472a508b88641c19a5fa61cd52158f92ab03966cfe80bbdfb

  • SSDEEP

    6144:Aary7GJaw2T4Hb4I2HIEi+nPHawBnN/sRm+Vmj1d2tvkUTWFnHR1/ZN2Fs:Ry7GJaXTC4IsjkvK1gtvkUTWFnH//ZN1

  Score

  10^/10

  latentbotdefense_evasiondiscoverypersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies firewall policy service

    defense_evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence
  behavioral1behavioral2