Extracted

• • Target

    5c28e2a53486ba7c8c6d5d5cd4b4175c_JaffaCakes118

  • Size

    678KB

  • MD5

    5c28e2a53486ba7c8c6d5d5cd4b4175c

  • SHA1

    0769d9e40455267aaf47a6a8dc4c65fce664ae0f

  • SHA256

    57432410d0b28e935b02053b4e2b6cf649e8ff3bbf8bd68e7a1ff181cb658c37

  • SHA512

    913e5eb7be5d1541f388d5fff394969f6007ed9bbd370ad98fb317ee81a4cd814ed14fa5b8562f37ea1a3d4e25f6622ccd381e3b942ea407cc9c386c119b2ee1

  • SSDEEP

    12288:E8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORixD:1UKoN0bUxgGa/pfBHDb+y1HgZ

  Score

  10^/10

  darkcometlatentbotpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2