Extracted

• • Target

    c55453a57b4f41620bb50d002f50e341_JaffaCakes118

  • Size

    1003KB

  • MD5

    c55453a57b4f41620bb50d002f50e341

  • SHA1

    25faa045341a77ebdc36b2f99589291dc20046f0

  • SHA256

    2d5520b0909d39d9cf10dcba82faf447b690bbbba82fc03ecce6f232a634b571

  • SHA512

    d9aad5d2ccfa983fab1b929e0329744bc7e135b38230bf47a870e05336fa72e81a2f905fb9ab522dbfb11fffe19433aa3394c7ba3eaaa99abd2d58ce53638ba7

  • SSDEEP

    24576:mja0HWLwdVWFkFIfP926yG0RL0ZzK1xK0NY:mjaeWs+bd2IRK1xK0

  Score

  10^/10

  darkcometlatentbotdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2