Extracted

• • Target
    VirusShare_d001a56d7bcefbbe40ce828b43f8c282
  • Size 568KB
  • SHA256 edcbfb22557600e273c62214a2ed57082a264921f290bb55cb0b1f4933a4c9b5
  • MD5 d001a56d7bcefbbe40ce828b43f8c282
  • SHA1 7bc392bbe16058067c7c3a35c03e0a9a7501eca2
  • SHA512 9844bfa20df4dcfeec2ab4d08795435bdc0e96ebfe185e0539cb206983a240717644c8975a2e3d2a4cc0835ae7cd42c86dc567aa626e741e669ed67653150466
  • SSDEEP 12288:MRxi53GNLlWKk8n5LqSC7i4fh50TldwT2bx/sfVgj25k+igXHLPlVyoXQyB:MRxi53GNLlWKX5LqSCO4fh50TlRhkXHl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  latentbotevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2