Extracted

• • Target

    764bd0f47d395a4a3e4abdf501d48402_JaffaCakes118

  • Size

    264KB

  • MD5

    764bd0f47d395a4a3e4abdf501d48402

  • SHA1

    ee6e39714fc6df19d0acf9a1a33494c82080580c

  • SHA256

    f6df2a467533efa9839443780f837572e796f599c8c1549cd8241cacbd531705

  • SHA512

    1edcdc167ca6d35fdfd4a32ad1535649dd49a0389461c498bffed11dfc43ab33d7c3c20dc85759cc87c594c228725f36c578d4e8b37cc11e1c20afcfb35f9969

  • SSDEEP

    6144:PIFqVA0HHhehYho+7VjNuBMNm2vOhxXbn4:k8DuBAOhRn4

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2