Extracted

Extracted

• • Target

    b545097b070ac19766a36b4617338363_JaffaCakes118

  • Size

    918KB

  • MD5

    b545097b070ac19766a36b4617338363

  • SHA1

    bbec26108117802436b079099a357c04296093fc

  • SHA256

    22fe32fd72a901239a5635d4fb6efe588e83812e10590cd64419c612e5649e24

  • SHA512

    1881ae7735e9dda6f87a3aebe4d73ffd303dd0e44c18116f6da7966ecae9d2a91e87f3956e228eaa55abffaf30f080c6bafc1603d8d43d9c2923175722387b97

  • SSDEEP

    24576:8gefGu8NaXaPkoekz4R7PbMxIozXVbv+4sQuTfpy1BGZ3s:au2iy7P0Bli4Q7peBU3

  Score

  10^/10

  darkcometlatentbotdarkzdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2