Extracted

Extracted

• • Target

    5e412597778f7df65155685a8bdcd4be_JaffaCakes118

  • Size

    1.3MB

  • MD5

    5e412597778f7df65155685a8bdcd4be

  • SHA1

    1086c375c09c07486f0542c679a74d61dd943594

  • SHA256

    f805abca58f0933dc66b09f7b9886394a92d481343df2851415f673b2b7ca0f2

  • SHA512

    579bb3cea0b8daa74b9221191d4ad484f92379f01f8298d055fb50e3ae0a58e15847b6933ab6d6960564ebd0625d680ca31b7d74e2a233d7b43ae9e9de1438da

  • SSDEEP

    24576:vFAABG9aJp25/4ddZMAsiIMXNI+RVN64AzFfoC9kAblzH2JCYkkX5zA:ZaaJpo/yZN6MXN9/NrAZgM2JlFA

  Score

  10^/10

  darkcometlatentbotskspersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2