Extracted

• • Target

    0eb8062d3c7a14a325a2e5d8c325f0ba_JaffaCakes118

  • Size

    810KB

  • MD5

    0eb8062d3c7a14a325a2e5d8c325f0ba

  • SHA1

    18988994bee5da320a137e4e7bb4ec3ef67f4fd6

  • SHA256

    572e7490570d77c3f37b52fd65dfe7eaa4d46cd716581640b567662a1fbd4831

  • SHA512

    22012f6166f694e0407a87f741c4064a7f2acadf22104a63f47686977327f2c7b59d3e16db5b55b18042e2a9c5c7ffc906306c4253233504a98b450c7f8e7810

  • SSDEEP

    12288:pC6Ut6RJ9mbupafIKsFzq3+lBxnX2Hf4CmmeKc1ett18n4SytyUkmgKGMsd28AeG:9MYMC2IBdUtCgiTyQdbHz3+SH4uG

  Score

  10^/10

  latentbotevasiontrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2