Extracted

Extracted

• • Target

    b979020d846ef76746d2c273b7f90af1_JaffaCakes118

  • Size

    802KB

  • MD5

    b979020d846ef76746d2c273b7f90af1

  • SHA1

    e94b6f19fa423e0905ab9a2b9ee61ffcd5cb486a

  • SHA256

    d1bd4c50eb5f9720f866793d9062c3596c147588778a1842d4f44af34bfac6be

  • SHA512

    facc09660611c062427376919becafaf007e62bbf19e73d88dc912e7d770de68c8f37314ed5fe44f7b426ecd93ed59570194f9caab41afb27bc476a504a5d760

  • SSDEEP

    24576:NSABEhmKLM1CioJuYrASHWuZw2uTZNsv75rG0jby:NSABwLxuA/WuG2aIjn6

  Score

  10^/10

  darkcometlatentbotaryandiscoveryevasionpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2