Extracted

• • Target

    7f43a45743093bc2a3f9f960e93a4b6b_JaffaCakes118

  • Size

    226KB

  • MD5

    7f43a45743093bc2a3f9f960e93a4b6b

  • SHA1

    e1976b50c922840240ab180d4ff0db3a45d7a38c

  • SHA256

    114f11282a33de6106fd56b854d3a0a4596f6b622e1ce43db43675e9725ff1e6

  • SHA512

    a6861d730f860cb143e8d6ac5a90329a15f90874f8872a11a1050c73e94321112d153c7df9d767b3e66a6429f621ca23620c7b5b558465747079c2488b4a0ea7

  • SSDEEP

    6144:hS9QWrvbXjz+PPzhh5klIE9mGQKBP/0BwISjlyyFmX:hS9Vv70Pzf2p9XZBH0B6Fm

  Score

  10^/10

  darkcometlatentbotdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies WinLogon for persistence

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2