Extracted

• • Target

    c9c69061db0bb3e9e3c9971e39e6ade5_JaffaCakes118

  • Size

    372KB

  • MD5

    c9c69061db0bb3e9e3c9971e39e6ade5

  • SHA1

    0bc90cc58ead84a58bf7b76504c78e97ba466455

  • SHA256

    595b87e20111426af2f187507b15bb974e33f825b9a8c3f2ac919d54bbb16518

  • SHA512

    804e6034256ab765ba271f62d99bf9f3b8d0237d5b86a4b1308e38797227051f78bb1b44dc641099b66327785267a7c3293c99e94dbe35b39429ae585c3acecd

  • SSDEEP

    6144:Giv3/5HDMepZeyLOnRWr/ozOMQZzBnRT/LXlel6d5jYyz0Kc:G1epKzOjZxl/E8XU

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2