Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-08-2024 16:45
General
-
Target
93e8c08c54bd81dc546f553998a990b0_JaffaCakes118.exe
-
Size
32KB
-
MD5
93e8c08c54bd81dc546f553998a990b0
-
SHA1
5d24e7c194aaab5127ef3d2fb250bc55aff1e6c8
-
SHA256
28e9fc24fa17332fc5489ce481d3d8be258893dccc895b17c68b1b7932d2f028
-
SHA512
f4acaab29425dac41a7855f96efc345630cad35d58ea0e032ef12c3c66c797c52c2d58ee8f271a8cd8b57f21d35dc9f57788291c83afe10cc41153f03bc9968d
-
SSDEEP
192:PmSEVT93jXKMVQBL6+yzDD06f9DCz1tqVKSFLD8LeuEXKFLslgDACJEn93jXW:KH3OsCy9tQ1g3FvLVMY6DAC293
Score
10/10
Malware Config
Extracted
Family
latentbot
C2
atualizador.zapto.org
Signatures
-
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\93e8c08c54bd81dc546f553998a990b0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\93e8c08c54bd81dc546f553998a990b0_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx