Extracted

Extracted

• • Target

    21993bae91a9f191d7ca6e94f742a82d_JaffaCakes118

  • Size

    312KB

  • MD5

    21993bae91a9f191d7ca6e94f742a82d

  • SHA1

    6dc84ac779ac3371ab56cc68d53284d6418aca68

  • SHA256

    4c828e297acd84caf86521a646b8ce561d7947a959ceb2b16bc4ec51c109fd9c

  • SHA512

    803ff89f88b1a9612a0bf660bd5d2fa56eef0f5fc6ca1cad4fd8901db321d0eeb468fb79f127e89f23f49d6481f6efb4c85f3d7dbfc5cbdafe580c65a709eac9

  • SSDEEP

    6144:Mi4HfwxTKCCHblh5sJPZGCTfs3nBmPWMG5O/bU3LQGpQ7GbRFyJFD:6/aGL5KPIAMnDVc/gbL3b/yP

  Score

  10^/10

  darkcometlatentbotessential666persistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2