Extracted

Extracted

• • Target

    2a56336d14687561184b0261a20d4608_JaffaCakes118

  • Size

    251KB

  • MD5

    2a56336d14687561184b0261a20d4608

  • SHA1

    21b870ce986e15fb6a0e1feeb540a85c80ed952d

  • SHA256

    d9e52e956ead8a1836a176dec93351acf8aeca690f8505ef0501bf1ff3ef0193

  • SHA512

    c76d0c92f1e112e219557791f84537ade94cd81be2235303f2683fbf7b29d5b620d019426625c6fb49e90736402c6e830d67cab9ffed98137469f85f5c15f544

  • SSDEEP

    6144:dRJQPYYabU6vUpFC0oc3kTyC8oh4rtTYRpVk5x:dYYP4C9IkTypoh4h

  Score

  10^/10

  darkcometlatentbotguest16persistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2