Extracted

• • Target

    JaffaCakes118_63b23379fd4291cc525dc9f732f9035e

  • Size

    109KB

  • MD5

    63b23379fd4291cc525dc9f732f9035e

  • SHA1

    ef6e6c40e66057cb0f2e34caa3557ee41a204773

  • SHA256

    a7cc8ae8da482a3515d1190bb23c354eaddbe59b44f854ea16230411e0dabf05

  • SHA512

    c2edada84174f5050ef85b7c407d6f36d0a088bc975b451457d911b423056fee76b3b9b620cd964b3588099cf3fd2496a1d006821a7c75a224891dfce9e679e5

  • SSDEEP

    1536:fsfUqZZaWKH8hx9ObpOU4xhx7GbY/UT1a5dcgEdV+76tl7/zC3K8beqE1zY:EBjKH8v9nUwmG6fdV+eweqYs

  Score

  10^/10

  latentbotdiscoverypersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2