Extracted

• • Target

    f65bce220a65369379b4cca2ce085581_JaffaCakes118

  • Size

    732KB

  • MD5

    f65bce220a65369379b4cca2ce085581

  • SHA1

    116d50a56a3d2ec07b3c742f10e41cb2152850d0

  • SHA256

    b14e0ad4aed51e262fd9f3e3f2216e34570022b5dda68e25ca649431d7b09906

  • SHA512

    3467b288be9a949b5111a37befa49302e8e445ae97913c859851446ef9124cdc152f3d7f600a220935784b1b75ec75510371cb751c65a6ed45bf26ff8b6900f9

  • SSDEEP

    12288:9lIBMFAuXEA2VpG778J/9WWbS3ykiIAYPVhcxK:6MFAqL2VpIU/9WWbUJAYPVhcxK

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2