Extracted

• • Target
    c4301978bfe1f1e601b8a9ccc63f2fbc4590b74bb46d6a95ed26f72a12556daa
  • Size 342KB
  • SHA256 c4301978bfe1f1e601b8a9ccc63f2fbc4590b74bb46d6a95ed26f72a12556daa
  • MD5 1a390ce9a38656bacbab2c736b376086
  • SHA1 8ed6c5c558ccef8562e9b414efc258933e60ea6f
  • SHA512 a42b3754c2e1ebba6c2cbae61825243f93c3d1322c08c924003a53af10c9fbc9c0f9d07854dae9a1cffe2ea99986cdb0250c6c9989abbd65c8c6c7d7eaf44a8a
  • SSDEEP 6144:9Rqmpp+amNOGokzLyM9tsLAitQo6tzOKkzIt8gKyfjxfR9D2j4yXoQHtVee:DqmpplpGoGL3etQoMiXM8gxf/Sj4yXlu
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  latentbotaspackv2discoverypersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies WinLogon for persistence

    persistence

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2