Extracted

• • Target

    2ac212a87bb46045f5a7a5a12c3e52c0_JaffaCakes118

  • Size

    843KB

  • MD5

    2ac212a87bb46045f5a7a5a12c3e52c0

  • SHA1

    387741a3ea824817965a0278217fed68924106fb

  • SHA256

    6ee2357a711223c3358a0bc1023f109b8c15a3fbeec6d4d1224ca3f10a69960f

  • SHA512

    6b357e2bb32ed9903af743525b16a70cb389a2b9942ac5e94f9abe6781b8dd8824e2127d88ee822dfd47f4dcc414ab18d09e90096335a60bd75b1b5616d01f62

  • SSDEEP

    12288:cRU5FD7S4NmkTSZ7GPFV/jtaFnAFDTzdwhYpitdsjYX7yHn+3if:LuyUsxj0nMTzdwrfrTif

  Score

  10^/10

  latentbotdiscoverypersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2