Extracted

• • Target

    c30768094ac436bcb8ddb1d6cd7851df_JaffaCakes118

  • Size

    1.5MB

  • MD5

    c30768094ac436bcb8ddb1d6cd7851df

  • SHA1

    a124c268aeb97a636feb04e36d10c935421f934d

  • SHA256

    8ca86898b70c075034942d2a36b88d17661fa273872b1e1b94fb3e1b6397f538

  • SHA512

    ed6923ae2396035c1b9f258614cb965c3ed4721cf5c431b76a2249b14cddae133a64fe90d0d78fce34e7c6f42d5f58cfe2c9da0585a75db539dacece43bf69b1

  • SSDEEP

    24576:koFJlvmcuWNij9W6CDvdKy5q7LQFyAJwBtpK6mgN5O51cyFDHVkl4:koblvmUaEvMN/QMi4I6mUq1cSDHVD

  Score

  10^/10

  darkcometlatentbotdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2