Extracted

• • Target

    8ae4eb2d7e85473257cc09a04ec1c7a7_JaffaCakes118

  • Size

    789KB

  • MD5

    8ae4eb2d7e85473257cc09a04ec1c7a7

  • SHA1

    9e3d450fb9d2862101d96118c9bb481e229e9a02

  • SHA256

    c322745791f5be92d2a7dcd41fbc9196c9615127c4f184323be9efe22c7f2831

  • SHA512

    8d4966f1b974bcf88adfbe2db0b99b481aef29e98800b61a557e74ad8fbf796fca099a3782e97b4856123294541366bf74ef45c1ca0fa9d60ac555b9939623fd

  • SSDEEP

    24576:of9Tr/Ao60sds11KFgDCdk5jqqheDe0kJyv:ofNYfsrKFgDCdiqqgyw

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies firewall policy service

    evasion

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2