Extracted

• • Target

    fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118

  • Size

    1.1MB

  • MD5

    fbf9993af55fd6b91076fe0280b9cf88

  • SHA1

    6215ab3eb496420ee1129c67177c376a98e62ea9

  • SHA256

    6c4f362c28bb72facbd384afffb2fafa91a0b9dae5b6f2fd8a51490e6598b756

  • SHA512

    9346e09cb01e4d1e5d7049b3a4f19c4e23828c26e599605087ebe1364124140c67e79ce1757dbb67dcd60cb1b77325967f16806253a8c6e495ff32e80fa8ca84

  • SSDEEP

    24576:uK/cRgOnmq9g61r43VHpmhg5yfenrkTf8/hytOXH2nek3zweOHc6KFvlvRdHwKV0:FcOU7m6aHpmiymQeSe2nTjweOHcl5QH

  Score

  10^/10

  latentbotdiscoverytrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2