Extracted

• • Target

    1e479f954d2399585aec7aeb0783bbc1_JaffaCakes118

  • Size

    778KB

  • MD5

    1e479f954d2399585aec7aeb0783bbc1

  • SHA1

    36757502115a0f4585549b37310a8b150236fec3

  • SHA256

    456daeb1ed3b635a9297fbe349f245adda4f1d62e8ba08a84d161f9ac097fabd

  • SHA512

    287e8b9df46e588cfe1a867010a598db05fcf1065cf2a7292b7a28c20040a50a45a56dd957c0abd598de38409b3c74d34f07ee2c3607a0bf31ed823525f582a8

  • SSDEEP

    24576:AHh8b+qK/cGks3yguUk57r6CyvIpqSus/Z:G9Lep57VuIpvB

  Score

  10^/10

  darkcometlatentbotpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies WinLogon for persistence

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2