General

  • Target

    JaffaCakes118_08203e58b4e6980e1db132d6481233e5

  • Size

    475KB

  • Sample

    250523-v3z2maynz6

  • MD5

    08203e58b4e6980e1db132d6481233e5

  • SHA1

    ac27e4744f7f7fafbb9db41b3f31946f94e966d8

  • SHA256

    b0040c834209fd3fb2484195ac260b423e2f2cfb02f967c538c112dc2f0f29ac

  • SHA512

    5602aa4a780f2a6fa8c83f5b06b637626ab21a0fb3729171e250bb6aa37e0a047be40f06961e72be8ad21dbf399765a9181472693e25da5a5e68c7d8fd2717ce

  • SSDEEP

    12288:hKnUk4255QVOmAW/5QAPGfp2kE4xYJaJae:IUSQVOmAW/myG7DxYJe

Malware Config

Extracted

Family

latentbot

C2

hackerbatudator.zapto.org

Targets

    • Target

      JaffaCakes118_08203e58b4e6980e1db132d6481233e5

    • Size

      475KB

    • MD5

      08203e58b4e6980e1db132d6481233e5

    • SHA1

      ac27e4744f7f7fafbb9db41b3f31946f94e966d8

    • SHA256

      b0040c834209fd3fb2484195ac260b423e2f2cfb02f967c538c112dc2f0f29ac

    • SHA512

      5602aa4a780f2a6fa8c83f5b06b637626ab21a0fb3729171e250bb6aa37e0a047be40f06961e72be8ad21dbf399765a9181472693e25da5a5e68c7d8fd2717ce

    • SSDEEP

      12288:hKnUk4255QVOmAW/5QAPGfp2kE4xYJaJae:IUSQVOmAW/myG7DxYJe

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

    • Latentbot family

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Modiloader family

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v16

Tasks