Extracted

• • Target

    17fbf593c2421dd8668c6a3e2bcda8cb_JaffaCakes118

  • Size

    767KB

  • MD5

    17fbf593c2421dd8668c6a3e2bcda8cb

  • SHA1

    e8f8d8587018522fd212ef0656ba7d937f585acc

  • SHA256

    b72dcae931e2413167f74b61cce77624d6eafc8fd7aee736b934adc2d5c8978f

  • SHA512

    495997eba5db7f175df3d1d026369eb38b3e28bd8ddba3308a39a0f24e207dc7847159679f4efe8a05c23dc5f6e03c9dda583b71ac156b1080d0542137e7b223

  • SSDEEP

    12288:XJN7zmaqznCIS/uTWW8Ffi7N1OOwM0zJ8gn9WSZs4ixsiNhkApRalh3Z:byjS/uQY7zOPJ8gn9WY1ifNhm

  Score

  10^/10

  latentbotdiscoverypersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2