Extracted

• • Target

    JaffaCakes118_67dd50bb66fcbf77329c0eb3d1d541df

  • Size

    305KB

  • MD5

    67dd50bb66fcbf77329c0eb3d1d541df

  • SHA1

    81b996d6a62b89b6f368b702f14642b962771dc6

  • SHA256

    d398e0da11e0aea30ac212f66f3facb8e9cc28883998e95d783d55cc340caec2

  • SHA512

    59c5c464d6c2b4914b2475e79542a91cb5b771fbd5db1d05a6c98ad2427d2cd9d6c8b9aae2f4fe1c30ea95457961aecdded2ba7acd1b2f1567016da446701162

  • SSDEEP

    6144:jb8Wt7QP7gCO5cOFmRnptuXHejp2J2iPHpc6iOIsaerGQlsFa5dsMcY:jb8WBxCOSRnptO+jp2oScDOdaerGQ8a1

  Score

  10^/10

  blackshadeslatentbotdefense_evasiondiscoverypersistencerattrojanupx

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades

  • Blackshades family

    blackshades

  • Blackshades payload

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies firewall policy service

    defense_evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2