Extracted

Extracted

• • Target

    c86fc7fd53318f3b349afc7e6917d4da_JaffaCakes118

  • Size

    714KB

  • MD5

    c86fc7fd53318f3b349afc7e6917d4da

  • SHA1

    268cc530681b53b39328493f0356d1b451f641bb

  • SHA256

    b698b3926296ddd844e359f482820483fb36b48a88e1e3f05992fedf69307ed8

  • SHA512

    5aede286cde54573aa4b191511c8de0f536f6f5fb5db9f6150fa12edfaf6b861384240a4a22bc40d4c2be7938ba20de35e80ac8b593356d3a01c023ffba18f35

  • SSDEEP

    12288:uIRG3HAdNawEuNP3NNuQAxKtGg6PVrDNnf9PULAK34+cUcaZOuI+YD4zykQI:lGM8uZNNuVxKtv6PthmLjFcFNXNk

  Score

  10^/10

  darkcometlatentbotcryptexdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2