Analysis
-
max time kernel
133s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
24-07-2024 16:38
General
-
Target
6c317fc0e35b001c9307734fae9ead91_JaffaCakes118.exe
-
Size
28KB
-
MD5
6c317fc0e35b001c9307734fae9ead91
-
SHA1
a3a280a883973d9c7ec7c93a560418357f961531
-
SHA256
9d5a9be2b2c34bd282493cd8c448632a4605e260ae3be46cd1a033117a95ece6
-
SHA512
5a22d853862a0be670741471c2c2a50eaf88cff62f508eb36a4e80864dee5bb5c83c7aa7e18ad7ea0bcf15fb0bfe4c46bb30d0a18c620fd517d73c884d0bfc4f
-
SSDEEP
192:xSUV345efvX4E19Qhz19qFgcbgwRrLqwEXSKHxEoGDAW7:z3fnl9QR1QTbX6bDClDAW7
Score
10/10
Malware Config
Extracted
Family
latentbot
C2
atualizador.zapto.org
Signatures
-
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c317fc0e35b001c9307734fae9ead91_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6c317fc0e35b001c9307734fae9ead91_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx