Extracted

• • Target

    5647eaaab2fdb519ee6dfa37c41ed4bc_JaffaCakes118

  • Size

    1.6MB

  • MD5

    5647eaaab2fdb519ee6dfa37c41ed4bc

  • SHA1

    e4a8d404159f195dd0f697d54c7048f7a1052f6d

  • SHA256

    ea82fd18e2bc55984294a2f16f5fa56c6f6917cfd11b7199934a5f2ae3957f98

  • SHA512

    41929071f4f2a284b3229b15359cacf5a84c8320913438fe49f950b0403e1b67af56e8459cc2a780eaa8206d729fdf8c88a966fbda0d38ce1434e25404fd18a7

  • SSDEEP

    49152:dNHe8fAIwgw4lAAx9BhmaCldEbi0z2sD9XYxfXCogCbF51+/ng6g/tu7jbCIeI:/He8fAIwgw4lAAx9Bhma+4isnBYxfXCz

  Score

  10^/10

  latentbotcredential_accessdiscoveryevasionpersistencespywarestealertrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2