blackshades | 31b918b6bc9c590590f00a5a3f78cf33fb54203798c0dd4d10499f4565e2e626 | Triage

Sharing

General

Target

JaffaCakes118_076c83ad982d295193b102fd4c1bd8a5
Size

340KB
Sample

250219-yjs1razjx7
MD5

076c83ad982d295193b102fd4c1bd8a5
SHA1

1761321d735829a254dff0bd6ff60a89cbd06eae
SHA256

31b918b6bc9c590590f00a5a3f78cf33fb54203798c0dd4d10499f4565e2e626
SHA512

7f7469c3de06a156866774eab81dc66a526ac460853f6b715373aa769df1283d19d172dfaf624eb343cd075e2244e12864688cba1bc9ab25f3f54e37b5aab514
SSDEEP

6144:ZG78LjzOANvSAsQLqF9pXMiY3sGB6UduRfLtcs:w7kmAN6omFMb3sGB6UduRfLas

Score

10^/10

blackshades latentbot defense_evasion discovery trojan

Malware Config

Extracted

Family

latentbot

C2

tommiserver.zapto.org

Targets

- Target
  
  JaffaCakes118_076c83ad982d295193b102fd4c1bd8a5
- Size
  
  340KB
- MD5
  
  076c83ad982d295193b102fd4c1bd8a5
- SHA1
  
  1761321d735829a254dff0bd6ff60a89cbd06eae
- SHA256
  
  31b918b6bc9c590590f00a5a3f78cf33fb54203798c0dd4d10499f4565e2e626
- SHA512
  
  7f7469c3de06a156866774eab81dc66a526ac460853f6b715373aa769df1283d19d172dfaf624eb343cd075e2244e12864688cba1bc9ab25f3f54e37b5aab514
- SSDEEP
  
  6144:ZG78LjzOANvSAsQLqF9pXMiY3sGB6UduRfLtcs:w7kmAN6omFMb3sGB6UduRfLas
Score

10^/10

latentbot defense_evasion discovery trojan
- LatentBot
  Modular trojan written in Delphi which has been in-the-wild since 2013.
  trojan latentbot
- Latentbot family
  latentbot
- Modifies firewall policy service
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

latentbotdefense_evasiondiscoverytrojan

behavioral2

latentbotdefense_evasiondiscoverytrojan