Extracted

Extracted

• • Target

    4a47e04852564dcd9f5881fbd69c6bd9_JaffaCakes118

  • Size

    414KB

  • MD5

    4a47e04852564dcd9f5881fbd69c6bd9

  • SHA1

    a6684ad9f665f0ebf6c243de8b8e309ce195d1fc

  • SHA256

    19d059c2008cdd0d30babc96de89c13c2dc38922cfc6f735af4902953469a0c4

  • SHA512

    82ee1980f8893c0bf6798c71864a4ee4f298cb5de875b81503fcd738c25150baa579c6e144f507ab6e48ff61af70d6a43bbb54d91752d74d182f1ad75bb43281

  • SSDEEP

    12288:MDxoIVCNZwI1eQu/tEzSha7GwAdTusAUa:6o1IIQNNQDWYUa

  Score

  10^/10

  darkcometlatentbotvictimpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2