Extracted

• • Target

    15bae297ef8d4db07e327c20aba3f8ea_JaffaCakes118

  • Size

    838KB

  • MD5

    15bae297ef8d4db07e327c20aba3f8ea

  • SHA1

    c6405960b0add36e255d880dc4fda6c106c13136

  • SHA256

    848dbec6a4031b28671092408054bd1a51f4c08d961107f41c42235cbd14eff1

  • SHA512

    ea619e23efc776aeb8e6db6c28f408933624a8e0e30ee4f851f12db92634e56629f0aeef4dba6a8f6c67973fa0d2b13e4b12d044ed81febae5dc212b7c970ef0

  • SSDEEP

    24576:bUKoN0bUxgGa/pfBHDb+y1HgZaOtgXu+7vv:QK1A6Ca

  Score

  10^/10

  darkcometlatentbotevasionpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies WinLogon for persistence

    persistence

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2