Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
03-11-2024 14:56
General
-
Target
8c0cb6989a0dfcc4498d13c0ba468a42_JaffaCakes118.pdf
-
Size
13KB
-
MD5
8c0cb6989a0dfcc4498d13c0ba468a42
-
SHA1
e21d6741fcc9529ef7f63138848fe08d044f7753
-
SHA256
de26b4254f2ded64b2f2c26e3ca3eaaeffba74b49e8e82a7ef038ea9e138cc0d
-
SHA512
cd35e4a29e570efca4af33c2b351ab83e6d4bf22174ea1096370267ecc6908a4b91a91ea1fca4d497b125ff4ed5350e4efa92b4f221e95425fc89d3a278b30f3
-
SSDEEP
192:rQhzajYqwAO9G+/vvTs7hXbfym4GJVbBftJy/suiXOvQNi/60un/T8qvROdjzwu:shzaNwAO9GiM5fdtttcQi/60G78s4djN
Score
10/10
Malware Config
Extracted
Family
latentbot
C2
ratbiiqbtal.zapto.org
Signatures
-
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
-
Latentbot family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8c0cb6989a0dfcc4498d13c0ba468a42_JaffaCakes118.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
472KB
-
Filesize
4KB