Overview

overview

10

Static

static

3

58ad655b70...18.exe

windows7-x64

10

58ad655b70...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    58ad655b70ab6de86b1c290c3d7273f2_JaffaCakes118
  • Size 485KB
  • Sample241018-v4as5azalg
  • SHA256 2b89e4ef4ff73447a28e22a878561d25f474c490509b83c1125cb9fd86ea0588
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
latentbotdiscoveryevasionpersistencetrojan

Malware Config

Extracted

Family

  • latentbot

C2

  • anonymousrocks.zapto.org

Targets

    • Target
      58ad655b70ab6de86b1c290c3d7273f2_JaffaCakes118
    • Size 485KB
    • SHA256 2b89e4ef4ff73447a28e22a878561d25f474c490509b83c1125cb9fd86ea0588
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    latentbotdiscoveryevasionpersistencetrojan

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

      trojanlatentbot

    • Modifies firewall policy service

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks