Extracted

Extracted

• • Target

    ad80fab1b61eedd00adda7872a1b81f8_JaffaCakes118

  • Size

    3.0MB

  • MD5

    ad80fab1b61eedd00adda7872a1b81f8

  • SHA1

    ab5ce17152b8363686e95f30bdc3adebe6976abe

  • SHA256

    a7e8eccf72d7f433cbe460d7b986b9044cbe4152a37717464c22cc5627997a43

  • SHA512

    6fb3ff62aaf54cb11a5ba8a4eea3255aecbca4c08169892a640182e0aad428b1a1f90361123f9d4b39d0640bc3497a94b00575bbad62b4dfd2221548b596b7c6

  • SSDEEP

    98304:bE3AkV49N65xEfyoc0GS+pkowEbUw6k8ZDz5:nkV49AxUyopGS+plwkUwSZz5

  Score

  10^/10

  darkcometlatentbotguest16discoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies WinLogon for persistence

    persistence

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  behavioral1behavioral2