Extracted

• • Target

    2ec0ba70a24a523cee42f7cfa3fde093_JaffaCakes118

  • Size

    657KB

  • MD5

    2ec0ba70a24a523cee42f7cfa3fde093

  • SHA1

    efc6ed6afa39c48701aaad915c7247800c2fc423

  • SHA256

    1d82eb685802be249d22545fef8ac55cd79ff5469d0e92162260aeab6847bf15

  • SHA512

    141f87655c8e947181b13c17dec5ae9fd046c57748989412a1af4c2c751d793a8a00aed2b9ffab8206aba79330dbb7cbbc7f01c696755b1e590871c9907c0186

  • SSDEEP

    12288:Eg5whZRvIvN6jj03BuaHH8lRAZ2b5g/jAzOrj+mDkFqNmFl4fk9MzVCPuOIPD38s:C0RgHticAf

  Score

  10^/10

  darkcometlatentbotpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2