Extracted

• • Target

    1f515e387041e92f55fda67c641e404c_JaffaCakes118

  • Size

    281KB

  • MD5

    1f515e387041e92f55fda67c641e404c

  • SHA1

    e5e3f0b8341fe70fdaa2261c05bb038fd2a12ece

  • SHA256

    1813a3cbd2ce370e1cfb072b0e48c198840e3bff70d916dd1094c0a0ce29a897

  • SHA512

    154c7958923169a2bbfd6059e1b6c037a65609f201947fe4f05e13ddb787dbd8a3ee6edf2d07a5c18c4fc206f911e8fa3f0568a1c0769cbcb50e2c80f8631bdd

  • SSDEEP

    6144:j1iJcYtR1HsvpSHY7KoSrfTNBuzZZcA1wnOLrMM4Qov:jkHcpSHY7VSrfT2/czO3HKv

  Score

  10^/10

  darkcometlatentbotevasionpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2