Extracted

• • Target

    JaffaCakes118_13a2ebdbf2362673c8b03d1d3632257f

  • Size

    469KB

  • MD5

    13a2ebdbf2362673c8b03d1d3632257f

  • SHA1

    c8a8254219ae9850666ccc7e90f3dbb0ced21b88

  • SHA256

    969c7c2eeabfcde6af5038bb7ff4e8e59ca0116e2b9f27b17830cae7af5f3355

  • SHA512

    13bc232497e4193fbd208080939d5edd49d569cd7a13a260f695aa47586227baa6f5f55559a4e69a92d0b4623b3d359b6c661e81ea2f5b0e8e3d9ca0f69e6767

  • SSDEEP

    12288:rHn6ZDfbQcw/0JJOY/CX3cmTDzQR0LxGa:j6tTQp/Qh/KbHzQR0Lx7

  Score

  10^/10

  latentbotdiscoverypersistencetrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2