Extracted

• • Target

    00d9a5e024a10ea49259a0cc5524f12b_JaffaCakes118

  • Size

    337KB

  • MD5

    00d9a5e024a10ea49259a0cc5524f12b

  • SHA1

    fb4c2578b54dccdae91cb547835893f9fe028ce1

  • SHA256

    7dbcc8ab214c297785e7fd297c88851d830630fdfb02bf437f29840231e3fa19

  • SHA512

    1e54b692e092247b79e503b29e81fff35cf3d670a4606e977ab9a329e87233aa6652678b28e46f8bda2d0064621d46a0dbd9aff3b6e584801f2797ff4d7d2337

  • SSDEEP

    6144:qcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL377Kf2D/Ix6GiC66A:qcW7KEZlPzCy377Kxx6rCi

  Score

  10^/10

  darkcometramnitgmrprdbankerevasionpersistenceratspywarestealertrojanupxworm

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies security service

    evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2