Extracted

Extracted

• • Target

    67abc4d8511bef88b5cd7b5884951bf5_JaffaCakes118

  • Size

    653KB

  • MD5

    67abc4d8511bef88b5cd7b5884951bf5

  • SHA1

    1e6e8907e291bb71e3d2d1b5050be3a60d39f646

  • SHA256

    71e9c343e1350db04d97d960f91163ea0d8c33d8149ab6225b0e018e8c161181

  • SHA512

    bdd62c7d12dad525a874c689a4f46c7ff068eb2b96620a6945b87ca6e66db54f21652c26ca10eae286f048accf634f1af85aff2439fd4985f596f3108bcd8b7a

  • SSDEEP

    12288:I5MlYxLWIpdgFFyIJjr2I9hPUkxuJzRUL9pYe2Xduxni+Tj:Ia4WLbJH2Wdx0JzRULjn2aT

  Score

  10^/10

  darkcometlatentbotoutboundpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2