Extracted

Extracted

• • Target

    b9cd3297cd60bb32abe1d37a05ef0779_JaffaCakes118

  • Size

    922KB

  • MD5

    b9cd3297cd60bb32abe1d37a05ef0779

  • SHA1

    c79999921c848f14a790ea2c3f812c2222596989

  • SHA256

    f50ab51897840e388714b30c6f7aeb7c417b301e6db37b0461dad0ecb70b8767

  • SHA512

    e5e82034d9a5da51bf3e08d820f5e33f5e139e19dd49ae292b06ba0d210b5c1ef7c5e163e7d48f5308c68c7c8f5de0d0f85576eb0382da980f2e97bf18091f01

  • SSDEEP

    12288:Seu+JqAw9tqlYN9vF38hfUxixGSIuIehGhl3M9JiJTUGh4i61QGGC2kDI7llnUsl:J1l8qlGFVkxsyGhMvi61rqSglVUs2A

  Score

  10^/10

  darkcometlatentbotguest16discoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies WinLogon for persistence

    persistence

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2