Extracted

• • Target
    1f515e387041e92f55fda67c641e404c_JaffaCakes118
  • Size 281KB
  • SHA256 1813a3cbd2ce370e1cfb072b0e48c198840e3bff70d916dd1094c0a0ce29a897
  • MD5 1f515e387041e92f55fda67c641e404c
  • SHA1 e5e3f0b8341fe70fdaa2261c05bb038fd2a12ece
  • SHA512 154c7958923169a2bbfd6059e1b6c037a65609f201947fe4f05e13ddb787dbd8a3ee6edf2d07a5c18c4fc206f911e8fa3f0568a1c0769cbcb50e2c80f8631bdd
  • SSDEEP 6144:j1iJcYtR1HsvpSHY7KoSrfTNBuzZZcA1wnOLrMM4Qov:jkHcpSHY7VSrfT2/czO3HKv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  darkcometlatentbotevasionpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2