Extracted

• • Target

    034008990065401ec63abc900844ddc0_JaffaCakes118

  • Size

    876KB

  • MD5

    034008990065401ec63abc900844ddc0

  • SHA1

    d0da539c9ad7c38570bd758d18aac526dd0134c7

  • SHA256

    a3de8af20fc5e7d71b9ad01d5e6421df29a8709c498145cbe0c599730eb6c286

  • SHA512

    05ad8546e952cbaefb2480a698acfbca8742da62b21dc198a875ef92a0059e503543ae227263c7c8924ef43a4eb51b48b97e9456ea29dc36ff237e8e407fe399

  • SSDEEP

    24576:Qdoj71WdnU4nuF3s4JFEeNePoEo9hTlDg0wutGgjT:fIdUiRUaoTtlXjT

  Score

  10^/10

  darkcometlatentbotpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2