Extracted

• • Target

    8256b9d70f90c9df0a72e1e9df7a9520_JaffaCakes118

  • Size

    1.5MB

  • MD5

    8256b9d70f90c9df0a72e1e9df7a9520

  • SHA1

    f3ab1dd95eb9efad5432797117a3574e66ecfb71

  • SHA256

    98f5bfa08294dc8ed3d342cae3c29406976a2272d8aba21222b636f420e1d6a1

  • SHA512

    b314646c7baa414c75e8ae07a23161ae1b7073c6be5a7c0631d39f84c7ef18254eb6d8d9c376ccfe0eb39fadac3c6304dbaf34dc4260fa0ad8e37448563176c8

  • SSDEEP

    49152:lUGEBRAokFtqpukfcpTpW77qkGeLelPh7LrgEy:lbORnkrqpukfATpWqeLeRNLrS

  Score

  10^/10

  latentbotdiscoverypersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2