Extracted

• • Target

    JaffaCakes118_87cd6f66e1b50d2de9df409f021c6501

  • Size

    616KB

  • MD5

    87cd6f66e1b50d2de9df409f021c6501

  • SHA1

    d653758be4a6f9e5e76c6543bef9fa10b405ca1a

  • SHA256

    13d61e2f92c2b12c6a96df221bb682cdc01311da2b5850e0d164a4deaa293b6e

  • SHA512

    f872bbd3b70d79a81a0d9a29017665ab554e2218ab7aad8d3d2df99f0b906c7df6c859ea11bf6c43f798e3e53cb7730c74931387d0123c5e5d22407878696aaf

  • SSDEEP

    12288:Cqsi023GwWM7BGa8WbVw6iA6FVoajsBskTs1v75EtlT1riiFpiYcvvumrr5wBh:bJC3YIdi0w

  Score

  10^/10

  blackshadeslatentbotdefense_evasiondiscoverypersistencerattrojanupx

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades

  • Blackshades family

    blackshades

  • Blackshades payload

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies firewall policy service

    defense_evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops file in Drivers directory

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2