General

  • Target

    JaffaCakes118_d098398c7b892d854e0876ae59a0418e

  • Size

    240KB

  • Sample

    250423-ck9h8sxpw3

  • MD5

    d098398c7b892d854e0876ae59a0418e

  • SHA1

    adeac0bf525f4cb881ddc9c7f2e5ecbc28e4d56a

  • SHA256

    15a82a3a9366e6fd52892516bb7e17d68441d19017d21da23f44dce66bbdd7d9

  • SHA512

    a2ec9853970c0d9d2539c5d3ddc53d617c46b4a5de960abd4d8646fbf759a54abe05891d005f13b54289136eacd051668fed3cd5233cafd122fa644800822dce

  • SSDEEP

    3072:J/vJHq08TARKeM6Xt9PFC685Th3ppvFTRphfUXcrOLj1H6gPWTzmfE9GdEhSvQEC:NvADARrMUFn8zjFf2XcKLR6gizUzdEhT

Malware Config

Extracted

Family

latentbot

C2

thequestion.zapto.org

Targets

    • Target

      JaffaCakes118_d098398c7b892d854e0876ae59a0418e

    • Size

      240KB

    • MD5

      d098398c7b892d854e0876ae59a0418e

    • SHA1

      adeac0bf525f4cb881ddc9c7f2e5ecbc28e4d56a

    • SHA256

      15a82a3a9366e6fd52892516bb7e17d68441d19017d21da23f44dce66bbdd7d9

    • SHA512

      a2ec9853970c0d9d2539c5d3ddc53d617c46b4a5de960abd4d8646fbf759a54abe05891d005f13b54289136eacd051668fed3cd5233cafd122fa644800822dce

    • SSDEEP

      3072:J/vJHq08TARKeM6Xt9PFC685Th3ppvFTRphfUXcrOLj1H6gPWTzmfE9GdEhSvQEC:NvADARrMUFn8zjFf2XcKLR6gizUzdEhT

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

    • Latentbot family

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Modiloader family

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v16

Tasks