Extracted

• • Target
    b14e71d5bcad365216db8480e29b7b8dc8182c07e72a287fa470e08de0d9c20eN
  • Size 568KB
  • SHA256 b14e71d5bcad365216db8480e29b7b8dc8182c07e72a287fa470e08de0d9c20e
  • MD5 e37eb3092d8fa42f9ae201a0228e4100
  • SHA1 8b3ded6ed64bb66ca7e5cdab8958646fa978aa75
  • SHA512 df14d17dca662b29317c11adba30a945a364d17bc0516edb6224c8874c17d8cfdad671ad8ab433aaf8b76137d62d82cfd88c52943ed3e9c4c0ab8d51cfb45ea3
  • SSDEEP 12288:dPg3IWCxPUcpBhHtMBA07i2bGSJxAAITfhnFVel9AMi:dg2tUcpRVai2z0xdnFVel9c
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  latentbotbootkitdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2