Extracted

Extracted

• • Target

    2cdc39f39a9369ae4062822ea6726f2e508d5d29514b3cee06f809ce6ef16250

  • Size

    1.9MB

  • MD5

    59646583129acf5244d686f15aadb25a

  • SHA1

    5b8b55dc12217eb37bd25ca61cd7aceec729e603

  • SHA256

    2cdc39f39a9369ae4062822ea6726f2e508d5d29514b3cee06f809ce6ef16250

  • SHA512

    99a4c6612de866f966f2b9f84c16ada59d3606db942011d720debe12f4b059a9aec1b7c1046231b15ae728b6a27e616056588680aa3ebcbf0340a4d6eeddb9b2

  • SSDEEP

    49152:Qe6RRRpEHQN/ThQrezxMQnXW8qaJZkRLagEoH6gFt:Q9nLEcrhhmYLwpbE+t

  Score

  10^/10

  latentbotdiscoverypersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Contacts a large (877) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4