Extracted

• • Target

    archivo2.vbs

  • Size

    24KB

  • MD5

    794acb71b278d769b345ae1128ba0c74

  • SHA1

    33ae0fddd4a8d0db765f988006aeb53d2fc4abeb

  • SHA256

    a2deefa26145a0ef56e012cb1020c6ba73d939a5deccd3088155d68c2995cbd1

  • SHA512

    81d1b09832762b9201205f13c68bd4958f5f5ede713a287d86da7144c4c333809bfd0e85d624a462c6130eb14307cccae49eb691a2f8a4642d5502f291763be2

  • SSDEEP

    384:E7EipzIp0YHdqR11111OiPNtj5oByRDjmvb0PZ/sRQO84uJSM8gJ/vHV:EoidI+Y9qX1tj5oPbS/sebLSM8gJ/vHV

  Score

  10^/10

  latentbotcollectiondiscoverytrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1