Extracted

• • Target

    9c1c607c7085f6819346979715dda033_JaffaCakes118

  • Size

    981KB

  • MD5

    9c1c607c7085f6819346979715dda033

  • SHA1

    166414beefabaf1866cfdfea8a72b222dcc674dc

  • SHA256

    9b0d3e63e3167214577b30e6f2e19034414f2f565c708f689de51390fe0c772e

  • SHA512

    f1824dd69f9250664c71ae28d5b1045c6551abc5af61f9f44cc0f877de722acb7100d72486584df614979dc27222dba1e1dbeddd02161afc633fab68670176b9

  • SSDEEP

    24576:T/////76QhEtOa5VxNmfFWBlI9G4hOkjIIkGhBLE:fREtO8xNmwB293rIvqB

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2