Extracted

Extracted

• • Target

    7ef58fae6597873eb9ddc200749efb54_JaffaCakes118

  • Size

    1.3MB

  • MD5

    7ef58fae6597873eb9ddc200749efb54

  • SHA1

    01b74eb79082d0465ab8654b6a71c8570ac8743a

  • SHA256

    046af6ee479e05559a9830dc541785559e7a006cc1761c1f9f6acd6b9fbef0e9

  • SHA512

    97bcd602af86fdab80368e376712739dc96535026b77b87b6ff5e5f53796c0f39f6ec33954b8655aff64b8ca3bf7faa7e666f8aa5790d8a974c8ca408d0be14f

  • SSDEEP

    24576:4DTCwXMdaEkx9Tod/Z/Va9nVFMG17y+g3LZjQsW2l9r/ArJf4q0/9xAN6:L4E0odR/SnVKaux3LZssW2lF4Ff43s6

  Score

  10^/10

  darkcometdarktracknanocorenjratgoogleserverhelperdiscoveryevasionkeyloggerpersistenceprivilege_escalationratspywarestealertrojan

  • DarkTrack

    DarkTrack is a remote administration tool written in delphi.

    ratstealerdarktrack

  • DarkTrack payload

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2