Extracted

• • Target

    425327bbfe7b32cb92f2ab09a3a92bca_JaffaCakes118

  • Size

    110KB

  • MD5

    425327bbfe7b32cb92f2ab09a3a92bca

  • SHA1

    96690fa13f54df4808d5a5c517b60bfdbfe7ca2d

  • SHA256

    a228a343318f93e4144cfb5196d2ec60e2cd4331b184a2ce385e861f7eda2645

  • SHA512

    193b78c6feb4d92747e72760f3df9b230b655072a4a18eeeb151489b93c88b312be72439cfcddf1d3150ac03d406a19d50da530c936c610b90f8cf9798026386

  • SSDEEP

    3072:kTTd5GzTXveGkSpG+nQ6XrxyRoTJttt/tttLUt9XI2EttLttttt5gted7:ATdcTX2G9M1YUU

  Score

  10^/10

  latentbotevasionpersistenceprivilege_escalationtrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2