Extracted

• • Target

    9eb8e309181d82c535d5a303bac0cd1d_JaffaCakes118

  • Size

    337KB

  • MD5

    9eb8e309181d82c535d5a303bac0cd1d

  • SHA1

    0148e74ee2ed3884211bcabce285b75648c56665

  • SHA256

    4f94699c00235e86c808d8c7a618d07ee116dabc92abba3d7c66a2b5856ff70b

  • SHA512

    dd0f692ef496a6a4248547ca15d7ea8c9cc73bcc2ce0f21745be740a93f8bd54e94662210cadf6a63cf872e14f8583a92f470ce9c4d717de5d5dcbc805af0a68

  • SSDEEP

    6144:uUc8SY8u+rv6Kl9QFhC6z3sbS4P2UI9icyXV13kPKuzGnVAZonRad//:uUcrY8driIQHG2D1axkPKd183

  Score

  10^/10

  darkcometlatentbotdiscoveryevasionrattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2