Extracted

• • Target

    cab18c9cc0d3290c93954e0aa29b38a7_JaffaCakes118

  • Size

    166KB

  • MD5

    cab18c9cc0d3290c93954e0aa29b38a7

  • SHA1

    aa1d682b22104ce72c3ad096b0ff5d094708a19d

  • SHA256

    0311cdcbc38c0d397043a292255c2423ebb409729ca0e123ba0cd1f0f3100598

  • SHA512

    dcbcdf44104245937611d14936bb9cf4b5c69d60f8b3ccb60a6b6853d639701e3947ca05a3ff446107aa711424e1b553b396b77db9266ce1025f1fb41070c593

  • SSDEEP

    3072:d/OEBk3dCedT2G6Fqbp9RJlAJZnKv1PBRmXlneyZlP+Zllk5y0xLE:7ktCCCGjVJlALv5eyHP4y53Q

  Score

  10^/10

  latentbotdiscoverypersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2