Extracted

• • Target

    b32887d66b27dadf480862b6cde5195f_JaffaCakes118

  • Size

    510KB

  • MD5

    b32887d66b27dadf480862b6cde5195f

  • SHA1

    66b90bf3e149e1b749e0712a0d2accfda3505994

  • SHA256

    df132f86e249516d4dff203d957d7d4ca2fc11b5da94d2a1474dec0e1ca74832

  • SHA512

    365b4fc55f02c9548a70424dd6ed2ef804a8e17d8d915cded281d64c51e300e460c4ac312d04eca56f2e40de7713058135ffb9226bb531fe18b75c6717a2c4fc

  • SSDEEP

    12288:wIx2yuzSCO1MvHBct+XAZTlV2YE5ichvg:dMzSC4mApZTl4Yy3Jg

  Score

  10^/10

  latentbotaspackv2discoverypersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies WinLogon for persistence

    persistence

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2