Extracted

• • Target

    14f75b2eb7c9e8e722489b60d1aac52a_JaffaCakes118

  • Size

    781KB

  • MD5

    14f75b2eb7c9e8e722489b60d1aac52a

  • SHA1

    a7babe3d0d25689bd4899a95f7d9ac746df7f61d

  • SHA256

    ba26910aee89ac869e6f56bcfba36c31c811d7fd5892ec34831873dac1eb3bdf

  • SHA512

    7010fd8a3f6e24328ba2672b813102f6097505d90f8dab85bae818edc8277e75284003d263c999f22834eb13c70e8282df66585e489468b828028f4c63e6fb83

  • SSDEEP

    12288:L5////cHfaAwe3erIn9Zo/a46rOpqFmORcibq3Uips8Zn4IH:L5////c/aAwbr2oJ6rELOyB3Ui3ZB

  Score

  10^/10

  latentbotevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2