Extracted

• • Target

    040ed61c5dad6e6958e9fa393400b0f7_JaffaCakes118

  • Size

    790KB

  • MD5

    040ed61c5dad6e6958e9fa393400b0f7

  • SHA1

    a52b4e7a914816c50e07fd21d6bc59a722a98f94

  • SHA256

    e4458a60485c68fd96ae268cc457923640eb954620dba34a277ac501ccac0f5e

  • SHA512

    416c1c6d70edec6d014949c507ae7ad5aae622070cfd39175853784f4705a9f75d9e427e1d0a8fcf3fbaf80a3ce94177419c585e339603b8ed7001f2ee4d76ad

  • SSDEEP

    24576:nvKf8nkBOYpXTLnGncGhaJ8XMeKeDPtR:vqVpDbKcGhaJoKeT

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2