latentbot | d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f

Analysis

max time kernel
150s
max time network
151s
platform
debian-9_mips
resource
debian9-mipsbe-20240418-en
resource tags

arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
03/01/2025, 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
Size

169KB
MD5

cac7a8f8c4b3cd1f2c1bd1f187c617eb
SHA1

3bbe81657aed5d688bda2b3456faab369abf1732
SHA256

d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f
SHA512

2df8eeab046c7d33adecc5a2edadc923985b577cd05dc8775623ebeff0621f8cc44ee7b1bef6ec32bde337f1d4355e1f4b335c35d30633b5d53b17a503dfd3ce
SSDEEP

1536:Cl2JvnXPvLrQuchMJdDNsCK9H1R8cA2iQembSM+xV7TfF+hPyO0Hb/zMt/Y:Cgv/fcwZsCK9VRhAX+bShFSP0HbbMlY

Score

10^/10

latentbot discovery trojan

Malware Config

Extracted

Family

latentbot

botnetdolly.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot
Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	a- M"!	729	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/14/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/709/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/735/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/742/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/779/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/807/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/18/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/67/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/740/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/792/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/810/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/813/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/21/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/37/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/327/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/783/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/816/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/114/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/752/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/756/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/4/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/5/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/164/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/759/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/784/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/811/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/72/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/762/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/776/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/782/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/821/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/834/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/10/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/24/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/104/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/379/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/781/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/826/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/833/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/23/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/758/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/780/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/801/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/16/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/74/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/373/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/665/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/721/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/731/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/761/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/789/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/12/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/68/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/320/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/743/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/806/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/818/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/829/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/7/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/77/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/720/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/734/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/36/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
File opened for reading	/proc/81/cmdline	d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf

/tmp/d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
/tmp/d3c7ddef9cacafd02109d8a840fc2c54fbc04cbfb32253f6f08182ef6d06221f.elf
1⤵
- Changes its process name
- Reads runtime system information
PID:729

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads