Extracted

• • Target

    JaffaCakes118_6a2e75a91d18eef40a7853c7f0df78ec

  • Size

    392KB

  • MD5

    6a2e75a91d18eef40a7853c7f0df78ec

  • SHA1

    8cc6a43f21594239091c8ac28fdf7527eaafa92d

  • SHA256

    debab5012c51986f8b4f82692b6af9591cd4bb376e1e859caef52bacad76fa9c

  • SHA512

    74f478f9b9807b8915d4afb28e9c4173aabf408a4f71a29d033ebb4ab58506fdb768d84d5170fccc2933a39aab91709d7d7dfcbe5f2e4a6407f2f13d41521fc7

  • SSDEEP

    6144:Y/W+tBHkO4KpQBiDTeaimvRbjie0/6h8QjDYFzIYjp2KyW8MmQ1zyI:YlXEyQBiPetCb50LmDYdIk2KKxo

  Score

  10^/10

  blackshadeslatentbotdefense_evasiondiscoverypersistencerattrojan

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades

  • Blackshades family

    blackshades

  • Blackshades payload

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies firewall policy service

    defense_evasion

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2