Extracted

• • Target

    506164d289c9268c2d5110fbbd1f869f_JaffaCakes118

  • Size

    229KB

  • MD5

    506164d289c9268c2d5110fbbd1f869f

  • SHA1

    1859f5ab624f041229bf5bcc0fc7e51ce37c1759

  • SHA256

    997784f4e7cc196eb51e63bcadb8f9eb1df487659f7aff1a15b3b261b7386099

  • SHA512

    cce94d6d82bed96da23862ab7b2c85e4000429894fa807b9822084318014a65d58e64ce9988149329489fc05a1fd03e230c94fa5598d7419d76b0e097a9af2ff

  • SSDEEP

    3072:7hergNTIyV6vM3XhfUbsGu/lNovKmvjMHrOitCNbu2ifOf73Nrtahv2m5FIhz:NenlqHrOicNKCTNkx5Fez

  Score

  10^/10

  latentbotpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2