Extracted

Extracted

• • Target

    JaffaCakes118_65682f641bbadc15ac3eec442feb4f41

  • Size

    399KB

  • MD5

    65682f641bbadc15ac3eec442feb4f41

  • SHA1

    5115cdffb6cdae8f475c901514d67556a1c5b797

  • SHA256

    2c7a657dfbea9c247ca711eb7e6e15387e0f4d502342f586689b8de8de3aad5d

  • SHA512

    d63e86b9099f4c43c8b24ba25773d57501318211b0209f2ca9ddda9e3e0803885bfd641314707c1f2ee1d876b15090c1535a7766f2526690aff046f50ff088b4

  • SSDEEP

    12288:hG9b2kkxA7FdnVS/pe9kfM9IWRTB1B/00:h3RAJJM/pRsIWRT9/00

  Score

  10^/10

  latentbotquasarcriokdefense_evasiondiscoveryspywaretrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • System Binary Proxy Execution: InstallUtil

    Abuse InstallUtil to proxy execution of malicious code.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2