Extracted

• • Target

    23a5eb38c422eba6ad53f6f87750a409_JaffaCakes118

  • Size

    1.0MB

  • MD5

    23a5eb38c422eba6ad53f6f87750a409

  • SHA1

    deedef041d8adba3a03bf0171034361b9addea85

  • SHA256

    baaf52f06256430addfe4303d0c4e0643c3d0c0a10f50912dc1d4a44d3d63265

  • SHA512

    a7c9885d2995b977452c40ff469c01e92e57d7a76050f7915128d98892566c6c1c2897e2f023a0d26b2edf56051484084c01ab8ce24b96060643845447ae50b8

  • SSDEEP

    24576:qGVOaElGNkG1BZ1i3NTjL++PzFRdE89K7j8jEShHYWrnF8LNYwA8J5:eCtEJz37I70ESlYWLaBr5

  Score

  10^/10

  latentbotbootkitcredential_accessdiscoveryevasionpersistencespywarestealertrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2