Extracted

Extracted

• • Target

    2b8dd53e6f531c98472caa5523af90d3_JaffaCakes118

  • Size

    312KB

  • MD5

    2b8dd53e6f531c98472caa5523af90d3

  • SHA1

    991754dd0a9a11b97d330d26e41883c4aa150c2d

  • SHA256

    73293d1e3e067e4d43106853085722f88e0f359ce7ae44e4634406c863666cd8

  • SHA512

    2b5595572def8eafd56d4f2f99abd3284f976ce4330e0f3dc385a6961e3781de15704a3e16f022fe9abd350af0d6b3e0f2719ed07808c23472843ff709de6abe

  • SSDEEP

    6144:0i4HfmxTKCCHblh5sJPZGCTfs3nBmPWMG5O/bU3LQGpQ7GbRFyJFN:y/AGL5KPIAMnDVc/gbL3b/yR

  Score

  10^/10

  darkcometlatentbotessential666persistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2