Extracted

• • Target

    archivo2.vbs

  • Size

    24KB

  • MD5

    a9c54e85a880f13da8f00ddc25bf5cf5

  • SHA1

    c239e6d0a997ff111944dd36e79f6995e721697e

  • SHA256

    eeb6cc149e5b3f30560cb7e9c0fc5f20b08f588dd905b2ad06a8c893971c3d19

  • SHA512

    7abf6d505e4880a4b71a64fd601a9c13a40966836a59361c0bae82e6470a07ac25979310cde1607067e6465e461833815fd88f8439b5e0332f180dcab6aad1ea

  • SSDEEP

    768:UOs/xYD5ezPaSPZtpHvC8o2qdsdelDLJiq:UOs/xTTx42qdAWp

  Score

  10^/10

  latentbotcollectiondiscoverytrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1