Extracted

• • Target

    5ee25cb261f9d9172c3ace48d150158b_JaffaCakes118

  • Size

    404KB

  • MD5

    5ee25cb261f9d9172c3ace48d150158b

  • SHA1

    a695c4c1c999dcf7f89b2e547cff652c9f459b47

  • SHA256

    f5479ca4e7dc218260c6b9613a6146aaec7726aca37568cc308d80f1fe8bea17

  • SHA512

    1e340e428962bccd0e26033f03e029d4532fb54903b8af2c55b6b6bc4b56fc873c47af5c9dedf2105d2353b5eb995836305be255c182845d154b2a96b051831c

  • SSDEEP

    6144:GTcq7mjYvGrq/fb3A8/1OHxyKC65jI5J+A+EHih3dqO7m+fPIj3HZxHEVAUFP:GS0+sfn76s+zEHih3X7m+uzEVTFP

  Score

  10^/10

  darkcometlatentbotpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2