General

  • Target

    http://tmpfiles.org/dl/637681/srvhost.exe

  • Sample

    250602-wb4q6sgl7s

Malware Config

Extracted

Family

latentbot

C2

grayhatgroupontop.zapto.org

Targets

    • Target

      http://tmpfiles.org/dl/637681/srvhost.exe

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

    • Latentbot family

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v16

Tasks