Extracted

• • Target

    JaffaCakes118_689c2d3c50d6b1077bcc6bbf5b7b41d0

  • Size

    764KB

  • MD5

    689c2d3c50d6b1077bcc6bbf5b7b41d0

  • SHA1

    eb65e48e4e0bb0f3320e3caa3dfe4bf41128f328

  • SHA256

    6b10733733dc5ece7a19af5a04064be7e8e79ed26099f5a62ffb9542e88c1ff5

  • SHA512

    384a552834935a2ae0087804dafeb02e2d91c8fdfe70f34fa00975585ec8a380e9278c943a01b9da12ed2d54cf33701646aa82a80109c136f5a20ef777de5414

  • SSDEEP

    12288:A6U2k7rdxYpsuudHHjpagRRy829hdmvT0a8FGMU3ymAOoJ7QwAO3P1o4tUp3Uro1:jU2MPYq1HHggRRy8wiAa7Mfmw5LbtUpv

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2