Analysis
-
max time kernel
140s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-01-2025 16:31
General
-
Target
JaffaCakes118_0f6d8b79e668c83c4d83acdb25d93456.exe
-
Size
285KB
-
MD5
0f6d8b79e668c83c4d83acdb25d93456
-
SHA1
f773f9fde2919dc4f63aad0a538ccb23dfffe234
-
SHA256
10abd2f7ecc4ddf2c6e2049f8d7eb9cdba77532c23c94a3aa9c2206b7f45becc
-
SHA512
e621ea7305c8a74e39fb9c8cd3ed57c3569e10ef08d9aada6dd0da79adf5997c3ddd1feb887474fdedc80be414564b3993db040075f17c23730058ce42f57565
-
SSDEEP
6144:rquhyzUJzsKs0/1aABimok07EQUVguT8Jb3ZgTexK:mU6Ks01c+AnUnab3ZgTe4
Score
10/10
Malware Config
Extracted
Family
latentbot
C2
dminformatica.zapto.org
Signatures
-
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
-
Latentbot family
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0f6d8b79e668c83c4d83acdb25d93456.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0f6d8b79e668c83c4d83acdb25d93456.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
-
Filesize
4KB
-
Filesize
784KB
-
Filesize
4KB
-
Filesize
784KB