Extracted

• • Target

    f0d0e641fa67338d491c6fa5a8ade01d_JaffaCakes118

  • Size

    753KB

  • MD5

    f0d0e641fa67338d491c6fa5a8ade01d

  • SHA1

    ad94af657ebbecff944f4e1697d1d9a52f141846

  • SHA256

    5578421f95c2c11168bebad9255652578a8ece9f468e60534fbd43d4223fddef

  • SHA512

    6976fab051a680813680ac7bf3e40a51cc596ae6efac80cdf6ae6ecb9e2c8424a3333fe15ba443699c10ec0575fe6c3130d42bd6e23e52cfca764282bdb293d8

  • SSDEEP

    12288:tpr0l2UOGhT/vPgTIRGbfzm9UdlnONcAc1dqmMfpE4E4:7rA2tGpPg0RALONcq

  Score

  10^/10

  discoveryevasionpersistencethemidalatentbottrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence
  behavioral1behavioral2