Extracted

• • Target
    c0a450f06575f4a463c486c8cdf69775
  • Size 434KB
  • SHA256 884f371bc0234626363d1ae84089fe785e86e5748334a0cb53902c5791eb272d
  • MD5 c0a450f06575f4a463c486c8cdf69775
  • SHA1 7d8c6bf41f812c22bc4813a2a26b65c812d9add6
  • SHA512 d4ae65557644f27f1544547f43c58b81f4498ab1e4d95cb0a95b2d810699c495e2091623422635f32d4d4965a4b6d336e33a19306aeb262aeeb3fba407551894
  • SSDEEP 12288:+AcEXkELYWiTVxqvf1PgYHh71Nmylhyl:BBXkYH4xqvf1PjB71Eylhyl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  latentbotevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2