General

  • Target

    2025-05-22_22e5c0e1c415bcf11a16a7763428bb03_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer_smoke-loader

  • Size

    5.2MB

  • Sample

    250522-lpxvnscr8s

  • MD5

    22e5c0e1c415bcf11a16a7763428bb03

  • SHA1

    76f91069de8b599459873ca425e165d7168a2f7e

  • SHA256

    016490d65b7accf1947fe1a9b3c0249fb107cb1369feb9698da8916822821d1c

  • SHA512

    3d8a42fff1d4f77320aae93eda1a3f8de0b58afaaa931dea4c4785190dad7fcd71bf06393ab343668b806556fc4a9a8a8569090bfdbbbfb415286acb07f5aa60

  • SSDEEP

    98304:Cps6efPfBOPvLtabi4X0MV+dYdcGt7VIb4:kfefPJws3V+a

Malware Config

Extracted

Family

latentbot

C2

myhostwin64.zapto.org

Targets

    • Target

      2025-05-22_22e5c0e1c415bcf11a16a7763428bb03_amadey_black-basta_elex_hellokitty_hijackloader_luca-stealer_smoke-loader

    • Size

      5.2MB

    • MD5

      22e5c0e1c415bcf11a16a7763428bb03

    • SHA1

      76f91069de8b599459873ca425e165d7168a2f7e

    • SHA256

      016490d65b7accf1947fe1a9b3c0249fb107cb1369feb9698da8916822821d1c

    • SHA512

      3d8a42fff1d4f77320aae93eda1a3f8de0b58afaaa931dea4c4785190dad7fcd71bf06393ab343668b806556fc4a9a8a8569090bfdbbbfb415286acb07f5aa60

    • SSDEEP

      98304:Cps6efPfBOPvLtabi4X0MV+dYdcGt7VIb4:kfefPJws3V+a

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

    • Latentbot family

    • Sets service image path in registry

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

MITRE ATT&CK Enterprise v16

Tasks